Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:Setup.exe
Analysis ID:1550454
MD5:5df7ccb72d4007e7fae710495b42de76
SHA1:0e38df6c075e5de92be6b99249d236089dac8d5b
SHA256:6c3e4398e3d563746b928bf359468f6baf416bf3f757ca789cdf7fab1f02a1b7
Infos:

Detection

Score:51
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:34
Range:0 - 100

Signatures

Multi AV Scanner detection for dropped file
Creates multiple autostart registry keys
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
EXE planting / hijacking vulnerabilities found
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Installs a global mouse hook
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • Setup.exe (PID: 7256 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 5DF7CCB72D4007E7FAE710495B42DE76)
    • chrome.exe (PID: 7360 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241106123744.238&_fcid=1730911513052455 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7588 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2008,i,3825837893827184749,16738686684280894307,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 3592 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4880 --field-trial-handle=2008,i,3825837893827184749,16738686684280894307,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 5852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=2008,i,3825837893827184749,16738686684280894307,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • nsb5A9.tmp (PID: 2736 cmdline: "C:\Users\user\AppData\Local\Temp\nsb5A9.tmp" /internal 1730911513052455 /force MD5: 84EE733F8014D22DAD2DFEF725489980)
      • PcAppStore.exe (PID: 8064 cmdline: "C:\Users\user\PCAppStore\PcAppStore.exe" /init default MD5: 4B88D8ADA8D22622C30D581FC38EAA52)
        • explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
          • PcAppStore.exe (PID: 4556 cmdline: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default MD5: 4B88D8ADA8D22622C30D581FC38EAA52)
        • UywbCAwwkazz.exe (PID: 3736 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 2816 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 3272 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 4940 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 3716 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 3872 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 2472 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 3492 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 2004 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 4464 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 4604 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 4416 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 1236 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 4268 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 1904 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 4340 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 2180 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 1748 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 2908 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 5544 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 3300 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 3756 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 2492 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 3180 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 2316 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 3020 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 3192 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • UywbCAwwkazz.exe (PID: 1456 cmdline: "C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • Watchdog.exe (PID: 7928 cmdline: "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241106123843.1985957453 /ver=fa.1092c MD5: 11F3801CB9FF046D6075F681971C4EB8)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\nsb5A9.tmp, ProcessId: 2736, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PCAppStore

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpReversingLabs: Detection: 45%
Source: C:\Users\user\PCAppStore\Uninstaller.exeReversingLabs: Detection: 29%
Machine Learning detection for sample
Source: Setup.exeJoe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpEXE: C:\Users\user\PCAppStore\Uninstaller.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpEXE: C:\Users\user\PCAppStore\Watchdog.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpEXE: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpEXE: C:\Users\user\PCAppStore\PcAppStore.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpEXE: C:\Users\user\PCAppStore\AutoUpdater.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpEXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to behavior
Source: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092cHTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092cHTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092cHTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092cHTTP Parser: No favicon

Compliance

barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpEXE: C:\Users\user\PCAppStore\Uninstaller.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpEXE: C:\Users\user\PCAppStore\Watchdog.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpEXE: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpEXE: C:\Users\user\PCAppStore\PcAppStore.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpEXE: C:\Users\user\PCAppStore\AutoUpdater.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpEXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to behavior
Uses 32bit PE files
Source: Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Creates a software uninstall entry
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStoreJump to behavior
Creates license or readme file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txtJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\ReadMe.txtJump to behavior
PE / OLE file has a valid certificate
Source: Setup.exeStatic PE information: certificate valid
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\Watchdog\x64\Release\Watchdog.pdb source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002742000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000002.3611553135.00007FF72482A000.00000002.00000001.01000000.00000017.sdmp, Watchdog.exe, 0000000B.00000000.2380188478.00007FF72482A000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb1 source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: UywbCAwwkazz.exe, 0000000E.00000000.2461479322.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000010.00000000.2470847783.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000011.00000002.3602292721.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000013.00000000.2481831021.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000014.00000000.2484863666.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000015.00000000.2488700201.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000017.00000002.3593700127.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000018.00000000.2498642452.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000019.00000000.2501045248.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000001A.00000002.3606688438.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000001B.00000002.3600980074.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000001C.00000000.2511399795.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000001D.00000000.2513190038.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000001E.00000000.2519484654.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000001F.00000002.3593648901.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000020.00000000.2521981223.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000021.00000002.3600017993.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000022.00000000.2524130677.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000023.00000000.2525620978.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000024.00000002.3596382368.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000025.00000002.3594038349.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000026.00000000.2533281250.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000027.00000000.2535912290.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000028.00000000.2538197974.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000029.00000002.3593590447.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000002A.00000000.2547219620.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000002B.00000002.3593590015.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000002C.00000000.2549893132.00000
Source: Binary string: C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb source: Setup.exe, 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\engine\Release\PCAppStore.pdb source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379707256.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474734373.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485846201.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C49
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00406873 FindFirstFileW,FindClose,0_2_00406873
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040290B FindFirstFileW,0_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpCode function: 9_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,9_2_00405D74
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpCode function: 9_2_0040699E FindFirstFileW,FindClose,9_2_0040699E
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpCode function: 9_2_0040290B FindFirstFileW,9_2_0040290B
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660C875F8 FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,10_2_00007FF660C875F8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660C876A8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,10_2_00007FF660C876A8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF7248116E0 FindClose,FindFirstFileExW,GetLastError,11_2_00007FF7248116E0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF724811754 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,11_2_00007FF724811754
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF724820330 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,11_2_00007FF724820330
Source: Joe Sandbox ViewIP Address: 209.222.21.115 209.222.21.115
Source: Joe Sandbox ViewIP Address: 147.182.211.77 147.182.211.77
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660B1CB80 GetTickCount64,Sleep,GetTickCount,Sleep,URLDownloadToFileW,Sleep,DeleteFileW,10_2_00007FF660B1CB80
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.3646193639.0000247C01154000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: @www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chromecache_286.3.drString found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=UA(a,c,e);S(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return S(122),!0;if(d&&f){for(var m=Ab(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},XA=function(){var a=[],b=function(c){return db(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.3632853098.0000247C002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chromecache_286.3.drString found in binary or memory: return b}lD.F="internal.enableAutoEventOnTimer";var Yb=ka(["data-gtm-yt-inspected-"]),nD=["www.youtube.com","www.youtube-nocookie.com"],oD,pD=!1; equals www.youtube.com (Youtube)
Source: chromecache_286.3.drString found in binary or memory: var AC=function(a,b,c,d,e){var f=rA("fsl",c?"nv.mwt":"mwt",0),g;g=c?rA("fsl","nv.ids",[]):rA("fsl","ids",[]);if(!g.length)return!0;var k=wA(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);S(121);if(m==="https://www.facebook.com/tr/")return S(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!dz(k,fz(b, equals www.facebook.com (Facebook)
Source: chrome.exe, 00000001.00000002.3641008038.0000247C00C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3078y
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3498=
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000001.00000002.3643239275.0000247C00EE0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000001.00000002.3643239275.0000247C00EE0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000001.00000002.3643239275.0000247C00EE0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/38323
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000001.00000002.3635624317.0000247C00694000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4551ange
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5430$
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5430X
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000001.00000002.3641008038.0000247C00C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000001.00000002.3641008038.0000247C00C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000001.00000002.3641008038.0000247C00C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6860rm
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6878b
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7036$
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000001.00000002.3641008038.0000247C00C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000001.00000002.3641008038.0000247C00C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000001.00000002.3641008038.0000247C00C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8229V
Source: chrome.exe, 00000001.00000002.3635624317.0000247C00694000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3630235172.0000247C0000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAt
Source: chrome.exe, 00000001.00000002.3634243225.0000247C004D8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_pa
Source: chrome.exe, 00000001.00000002.3649283903.0000247C01568000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000001.00000002.3649283903.0000247C01568000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx352.0/$
Source: chrome.exe, 00000001.00000002.3641210009.0000247C00C40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppeemjh
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihi
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/adb2qwdrzgsbze5reot2ljihgpqa_9275/hfnkpimlhhgieaddgfe
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/adohe7tf6ytr4v66tjma7zsnb3wq_1123/efniojlnjndmcbiieeg
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpng
Source: chrome.exe, 00000001.00000002.3636593722.0000247C00784000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/obed
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanleaf
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkjd
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcji
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaea
Source: chrome.exe, 00000001.00000002.3635557190.0000247C0067C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/kuv6sxh4r3bgt6ctayzn6cl44e_3049/jflookgnkcckhobaglndi
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbnf
Source: chrome.exe, 00000001.00000002.3647313539.0000247C01318000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dns-tunnel-check.googlezip.net/connect
Source: chrome.exe, 00000001.00000002.3647313539.0000247C01318000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dns-tunnel-check.googlezip.net/connect$
Source: chrome.exe, 00000001.00000002.3638941628.0000247C00A3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00
Source: chrome.exe, 00000001.00000002.3630976565.0000247C000B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_
Source: chrome.exe, 00000001.00000002.3652172672.0000247C01B9C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0
Source: chrome.exe, 00000001.00000002.3639302827.0000247C00A88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adohe7tf6ytr4v66tjma7zsnb3wq_1123/efniojl
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.23
Source: chrome.exe, 00000001.00000002.3631472984.0000247C0014C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.69042
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305
Source: chrome.exe, 00000001.00000002.3639302827.0000247C00A88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/k
Source: chrome.exe, 00000001.00000002.3639302827.0000247C00A88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/go
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/nei
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbog
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/kuv6sxh4r3bgt6ctayzn6cl44e_3049/jflookgnk
Source: chrome.exe, 00000001.00000002.3639302827.0000247C00A88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.120
Source: chrome.exe, 00000001.00000002.3630735781.0000247C0009E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: chrome.exe, 00000001.00000002.3624960382.00000265592A7000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://localhost:64111/browseore/api/api.php8899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%
Source: Setup.exe, 00000000.00000000.1725173736.000000000040A000.00000008.00000001.01000000.00000003.sdmp, Setup.exe, 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmp, nsb5A9.tmp, 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, nsb5A9.tmp, 00000009.00000002.2514718880.0000000002EBE000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000000.2012166234.000000000040A000.00000008.00000001.01000000.0000000F.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS0
Source: chrome.exe, 00000001.00000002.3630976565.0000247C000B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64
Source: chrome.exe, 00000001.00000002.3652172672.0000247C01B9C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.cr
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgy
Source: chrome.exe, 00000001.00000002.3634243225.0000247C004D8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_thir
Source: chrome.exe, 00000001.00000002.3649283903.0000247C01568000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppe
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnn
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/adb2qwdrzgsbze5reot2ljihgpqa_9275/hfnkpimlhhgiead
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/adohe7tf6ytr4v66tjma7zsnb3wq_1123/efniojlnjndmcbi
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eei
Source: chrome.exe, 00000001.00000002.3636593722.0000247C00784000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncan
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjd
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3638397742.0000247C00998000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindgg
Source: chrome.exe, 00000001.00000002.3635557190.0000247C0067C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhl
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/kuv6sxh4r3bgt6ctayzn6cl44e_3049/jflookgnkcckhobag
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkeh
Source: chrome.exe, 00000001.00000002.3638603957.0000247C009E8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000001.00000002.3640225220.0000247C00B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2469395455.0000247C00B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000001.00000002.3630506082.0000247C00064000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000001.00000002.3641008038.0000247C00C0C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3633789568.0000247C003C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000001.00000002.3641008038.0000247C00C0C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3630235172.0000247C0000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000001.00000002.3630976565.0000247C000B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000001.00000002.3630976565.0000247C000B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000001.00000002.3630976565.0000247C000B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000001.00000002.3630506082.0000247C00064000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000001.00000002.3639235216.0000247C00A70000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://alling.p
Source: chrome.exe, 00000001.00000002.3623182942.0000026558B1D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://analytics.google.com/g/collect?v=2&tid=G-VFQWFX3X1C&gtm=45je4au0v898645365za200zb9103256652&
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7162c
Source: chrome.exe, 00000001.00000002.3641008038.0000247C00C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7369_
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7604%
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000001.00000002.3636655492.0000247C0078C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3640225220.0000247C00B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2469395455.0000247C00B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000001.00000002.3640530210.0000247C00BA0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000001.00000002.3640530210.0000247C00BA0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000001.00000002.3639824490.0000247C00B20000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000001.00000002.3639824490.0000247C00B20000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000001.00000002.3639824490.0000247C00B20000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000001.00000002.3633928764.0000247C00454000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2522796610.0000247C00454000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000001.00000002.3635557190.0000247C0067C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3630235172.0000247C0000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000001.00000002.3635557190.0000247C0067C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000001.00000002.3638290572.0000247C00984000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3638603957.0000247C009E8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en)
Source: chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en106243$
Source: chrome.exe, 00000001.00000002.3622488919.0000026558670000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000001.00000002.3622488919.0000026558670000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000001.00000002.3629742965.0000122C00794000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000001.00000002.3629742965.0000122C00794000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000001.00000002.3622488919.0000026558670000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/(
Source: chrome.exe, 00000001.00000002.3622488919.0000026558670000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/(TrustTokenOperationsRequiringOriginTrial#all-operat
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000001.00000002.3630235172.0000247C0000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 00000001.00000002.3635390203.0000247C0065A000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3640225220.0000247C00B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3635693052.0000247C006B0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3635761944.0000247C006D0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2469395455.0000247C00B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3630235172.0000247C0000C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3635168263.0000247C0061C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000001.00000002.3635693052.0000247C006B0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crxOG
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000001.00000002.3633111732.0000247C00300000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.c
Source: chrome.exe, 00000001.00000002.3645549209.0000247C010DD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3653385439.0000247C01C78000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-serving
Source: chrome.exe, 00000001.00000002.3639824490.0000247C00B20000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3653074847.0000247C01C30000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-serving6
Source: chrome.exe, 00000001.00000002.3639071855.0000247C00A48000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-servingCross-Origin-Resource-Policy:
Source: chrome.exe, 00000001.00000002.3632384425.0000247C0027C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/apps-themes
Source: chrome.exe, 00000001.00000002.3632384425.0000247C0027C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/apps-themesn
Source: chrome.exe, 00000001.00000002.3622549520.000002655875D000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3653709434.0000247C01D54000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3640530210.0000247C00BA0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3636593722.0000247C00784000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
Source: chrome.exe, 00000001.00000002.3640530210.0000247C00BA0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control:
Source: chrome.exe, 00000001.00000002.3622549520.000002655875D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1d
Source: chrome.exe, 00000001.00000002.3653709434.0000247C01D54000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1f
Source: chrome.exe, 00000001.00000002.3636593722.0000247C00784000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1g
Source: chrome.exe, 00000001.00000002.3633111732.0000247C00300000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3636191841.0000247C00742000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3633111732.0000247C00300000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1Content-Security-Policy:
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3633111732.0000247C00300000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1Content-Type:
Source: chrome.exe, 00000001.00000002.3631760879.0000247C0018C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1Tog$
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1d
Source: chrome.exe, 00000001.00000002.3631760879.0000247C0018C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1dg$
Source: chrome.exe, 00000001.00000002.3631760879.0000247C0018C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1dog$
Source: chrome.exe, 00000001.00000002.3639071855.0000247C00A48000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving
Source: chrome.exe, 00000001.00000002.3653264804.0000247C01C5C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0
Source: chrome.exe, 00000001.00000002.3653790485.0000247C01D74000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0
Source: chrome.exe, 00000001.00000002.3622549520.000002655875D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
Source: chrome.exe, 00000001.00000002.3635897933.0000247C006F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
Source: chrome.exe, 00000001.00000002.3623182942.0000026558B1D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
Source: chrome.exe, 00000001.00000002.3653790485.0000247C01D74000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0Cross-Origin-Opener-Policy-Report-Only:
Source: Setup.exe, 00000000.00000002.2024704807.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2022720793.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2023756429.00000000005BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/
Source: Setup.exe, 00000000.00000002.2024704807.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2022720793.0000000002AD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/5
Source: Setup.exe, 00000000.00000002.2023756429.00000000005BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=&evt_src=fa_mini_insta
Source: Setup.exe, 00000000.00000003.2021965125.0000000002AEF000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=ersion=fa.1092c&src=pc
Source: Setup.exe, 00000000.00000003.2022062689.0000000002A85000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092c
Source: Setup.exe, 00000000.00000002.2024704807.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2022720793.0000000002AD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/e_
Source: Setup.exe, 00000000.00000002.2023756429.000000000061D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/~
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjA
Source: chrome.exe, 00000001.00000002.3634243225.0000247C004D8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_p
Source: chrome.exe, 00000001.00000002.3649283903.0000247C01568000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppeemj
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkih
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/adb2qwdrzgsbze5reot2ljihgpqa_9275/hfnkpimlhhgieaddgf
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/adohe7tf6ytr4v66tjma7zsnb3wq_1123/efniojlnjndmcbiiee
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpn
Source: chrome.exe, 00000001.00000002.3636593722.0000247C00784000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/obe
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanlea
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkj
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3638397742.0000247C00998000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcj
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaae
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/kuv6sxh4r3bgt6ctayzn6cl44e_3049/jflookgnkcckhobaglnd
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbn
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3632853098.0000247C002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3632853098.0000247C002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3636655492.0000247C0078C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3632853098.0000247C002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3636655492.0000247C0078C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3650533937.0000247C01908000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3648323304.0000247C01464000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3647313539.0000247C01318000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3649623700.0000247C0160C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3650945344.0000247C01994000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3647986098.0000247C013EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3647647197.0000247C0137C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3648120263.0000247C01420000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3649121638.0000247C01534000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3649688246.0000247C01630000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3650804234.0000247C01968000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/
Source: chrome.exe, 00000001.00000002.3648323304.0000247C01464000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3647313539.0000247C01318000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3650945344.0000247C01994000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3647986098.0000247C013EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3647647197.0000247C0137C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3648120263.0000247C01420000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3649121638.0000247C01534000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/ore/
Source: chrome.exe, 00000001.00000002.3650804234.0000247C01968000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/rPolicy
Source: chrome.exe, 00000001.00000002.3650804234.0000247C01968000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/rmorithm
Source: chrome.exe, 00000001.00000002.3649623700.0000247C0160C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3649688246.0000247C01630000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/t/
Source: chrome.exe, 00000001.00000002.3649623700.0000247C0160C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/t/$
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3633564470.0000247C00390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3640530210.0000247C00BA0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3635693052.0000247C006B0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000001.00000002.3635693052.0000247C006B0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000001.00000002.3640225220.0000247C00B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2469395455.0000247C00B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000001.00000002.3637242096.0000247C0085C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000001.00000002.3636655492.0000247C0078C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.ico
Source: chrome.exe, 00000001.00000002.3630976565.0000247C000B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64
Source: chrome.exe, 00000001.00000002.3652172672.0000247C01B9C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.cr
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adb2qwdrzgsbze5reot2ljihgpqa_9275/hfnkpi
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adohe7tf6ytr4v66tjma7zsnb3wq_1123/efnioj
Source: chrome.exe, 00000001.00000002.3636593722.0000247C00784000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.2
Source: chrome.exe, 00000001.00000002.3631472984.0000247C0014C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.6904
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.130
Source: chrome.exe, 00000001.00000002.3639302827.0000247C00A88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/
Source: chrome.exe, 00000001.00000002.3639302827.0000247C00A88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/g
Source: chrome.exe, 00000001.00000002.3639302827.0000247C00A88000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/ne
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbo
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/kuv6sxh4r3bgt6ctayzn6cl44e_3049/jflookgn
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.12
Source: chrome.exe, 00000001.00000002.3646425790.0000247C011A1000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3640737536.0000247C00BC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://fonts.gstatic.com/
Source: chrome.exe, 00000001.00000002.3653957279.0000247C01DD4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://goog.com
Source: chrome.exe, 00000001.00000002.3622488919.0000026558670000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000001.00000002.3622488919.0000026558670000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000002.3630976565.0000247C000B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000001.00000002.3649489759.0000247C015E4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
Source: chrome.exe, 00000001.00000002.3645549209.0000247C010C8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3653074847.0000247C01C30000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730914671161&cv=
Source: chrome.exe, 00000001.00000002.3645549209.0000247C010C8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3653074847.0000247C01C30000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730914671189&cv=
Source: chrome.exe, 00000001.00000002.3653074847.0000247C01C30000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730914671204&cv=
Source: chrome.exe, 00000001.00000002.3650533937.0000247C01908000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3647313539.0000247C01318000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3649623700.0000247C0160C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3648594433.0000247C014CC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3641008038.0000247C00C0C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3648457861.0000247C014A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3649688246.0000247C01630000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3648991397.0000247C01504000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/
Source: chrome.exe, 00000001.00000002.3649623700.0000247C0160C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/$
Source: chrome.exe, 00000001.00000002.3650533937.0000247C01908000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/=
Source: chrome.exe, 00000001.00000002.3648457861.0000247C014A0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/cy
Source: chrome.exe, 00000001.00000002.3648457861.0000247C014A0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/ithm
Source: chrome.exe, 00000001.00000002.3648594433.0000247C014CC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/y
Source: chrome.exe, 00000001.00000002.3643918168.0000247C00F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000001.00000002.3643918168.0000247C00F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000001.00000002.3643918168.0000247C00F94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000001.00000002.3622488919.0000026558670000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3628081871.0000122C00288000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000001.00000002.3629677786.0000122C00780000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3622488919.0000026558670000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3636850776.0000247C007C8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3628081871.0000122C00288000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000001.00000002.3622488919.0000026558670000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboard#exps-registration-success-page-urls
Source: chrome.exe, 00000001.00000002.3622488919.0000026558670000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboardPi
Source: chrome.exe, 00000001.00000002.3629677786.0000122C00780000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000002.3622488919.0000026558670000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000002.3629613533.0000122C00754000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3629742965.0000122C00794000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3622488919.0000026558670000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000001.00000002.3622488919.0000026558670000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/upload#companion-iph-blocklisted-page-urls
Source: chrome.exe, 00000001.00000002.3629742965.0000122C00794000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000001.00000002.3629742965.0000122C00794000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000001.00000002.3629613533.0000122C00754000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000001.00000002.3633242908.0000247C0032C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3631196894.0000247C000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3631196894.0000247C000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3631196894.0000247C000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3631196894.0000247C000EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3633564470.0000247C00390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3636655492.0000247C0078C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000001.00000002.3635624317.0000247C00694000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3637961241.0000247C0091C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000001.00000002.3635624317.0000247C00694000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3637961241.0000247C0091C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000001.00000002.3635624317.0000247C00694000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3637961241.0000247C0091C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000001.00000002.3640392857.0000247C00B92000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3641276799.0000247C00C4C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3639385162.0000247C00AB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000002.3641645705.0000247C00C94000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3641276799.0000247C00C4C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3640530210.0000247C00BA0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000001.00000002.3640392857.0000247C00B92000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3641276799.0000247C00C4C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3639385162.0000247C00AB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000001.00000002.3640392857.0000247C00B92000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3641645705.0000247C00C94000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3633047942.0000247C002F0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3641276799.0000247C00C4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000001.00000002.3640392857.0000247C00B92000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3633047942.0000247C002F0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3641276799.0000247C00C4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000001.00000002.3640392857.0000247C00B92000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3641645705.0000247C00C94000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3641276799.0000247C00C4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000002.3641645705.0000247C00C94000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3641276799.0000247C00C4C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3640530210.0000247C00BA0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000001.00000002.3640392857.0000247C00B92000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3641645705.0000247C00C94000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3641276799.0000247C00C4C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3639385162.0000247C00AB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000001.00000002.3651661672.0000247C01B10000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3623017898.0000026558AE7000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_jig=$
Source: chrome.exe, 00000001.00000002.3650323523.0000247C018EC000.00000004.00000001.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3615580090.0000021AF8330000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.3018690212.0000021AF8330000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.st
Source: chrome.exe, 00000001.00000002.3639450498.0000247C00ABC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.stD
Source: chrome.exe, 00000001.00000002.3652596144.0000247C01BDC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3644714654.0000247C01022000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store
Source: chrome.exe, 00000001.00000002.3641857260.0000247C00CAC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store$
Source: chrome.exe, 00000001.00000002.3649489759.0000247C015E4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3638397742.0000247C00998000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3644714654.0000247C01022000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3645406315.0000247C010B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3634760636.0000247C005B0000.00000004.00000001.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000002.2514328480.000000000078C000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2512692026.000000000078C000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.3018634210.0000021AF83BA000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.3018663231.0000021AF83C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/
Source: chrome.exe, 00000001.00000002.3635624317.0000247C00694000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3638873524.0000247C00A28000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3638397742.0000247C00998000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/$
Source: chrome.exe, 00000001.00000002.3646911036.0000247C01221000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2522728324.0000247C01A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3651215485.0000247C01A94000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3625651740.000002655B303000.00000002.00000001.00040000.0000001D.sdmpString found in binary or memory: https://pcapp.store//
Source: chrome.exe, 00000001.00000002.3638941628.0000247C00A3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/11513052455
Source: chrome.exe, 00000001.00000002.3654593069.0000247C02424000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/?p=lpd_instal
Source: chrome.exe, 00000001.00000002.3649489759.0000247C015E4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3646128007.0000247C01134000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3645406315.0000247C010B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=17309115130
Source: chrome.exe, 00000001.00000002.3654593069.0000247C02424000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/?p=lpd_instalng
Source: Setup.exe, 00000000.00000002.2024704807.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2022720793.0000000002AD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/LMEMH
Source: Setup.exe, 00000000.00000002.2024704807.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2022720793.0000000002AD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/P/c
Source: chrome.exe, 00000001.00000002.3652381615.0000247C01BBC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/RDio_5w&random=3605072228&rmt_tld=0&ipr=y
Source: chrome.exe, 00000001.00000002.3649688246.0000247C01630000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3635311998.0000247C0062C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3630235172.0000247C0000C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3645103667.0000247C0105C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3637032513.0000247C0080C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/api/api.php
Source: chrome.exe, 00000001.00000002.3635624317.0000247C00694000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3645103667.0000247C0105C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/api/api.php$
Source: chrome.exe, 00000001.00000002.3633047942.0000247C002F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/api/api.php=https%3A%2F%2Fpcapp.storeone_cursor_icon.svg
Source: Setup.exe, 00000000.00000002.2023848065.0000000000660000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/inst_cpg.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&ve
Source: Setup.exe, 00000000.00000002.2023756429.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000002.2514043188.0000000000731000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/installing.php?guid=&winver=
Source: Setup.exe, 00000000.00000002.2024704807.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2022720793.0000000002AD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE
Source: chrome.exe, 00000001.00000002.3628531102.0000122C002F2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-
Source: Setup.exe, 00000000.00000002.2024704807.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2022720793.0000000002AD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93B
Source: chrome.exe, 00000001.00000002.3637961241.0000247C0091C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3656455326.00004464002A4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3649489759.0000247C015E4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa
Source: chrome.exe, 00000001.00000002.3644960803.0000247C01030000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/js?id=G-VFQWFX3X1C
Source: chrome.exe, 00000001.00000002.3651661672.0000247C01B10000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3649901911.0000247C01684000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3646771390.0000247C011E8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3650871477.0000247C01980000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3650804234.0000247C01968000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3648662244.0000247C014D4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3645406315.0000247C010B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.ico
Source: chrome.exe, 00000001.00000002.3648789473.0000247C014E4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.ico$
Source: chrome.exe, 00000001.00000002.3635897933.0000247C006F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.ico5
Source: chrome.exe, 00000001.00000002.3648662244.0000247C014D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.icoi
Source: chrome.exe, 00000001.00000002.3650871477.0000247C01980000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.icopH
Source: chrome.exe, 00000001.00000003.2469710991.0000247C01AA4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/lpd_installing_r2/src/lpd_installing_r2.min.js?nocache=1709636059406
Source: Setup.exe, 00000000.00000002.2024704807.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2022720793.0000000002AD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/p.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092c
Source: chrome.exe, 00000001.00000002.3645177744.0000247C01080000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=173091151305
Source: Setup.exe, 00000000.00000002.2023848065.0000000000638000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000002.2514043188.0000000000744000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2348174329.000000000388A000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000002.2514328480.000000000078C000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2351633264.0000000003858000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2353027488.0000000003857000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2351831318.0000000003858000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2512692026.000000000078C000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2352338287.0000000003857000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2352792945.0000000003857000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2348174329.0000000003886000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000002.2519634054.0000000003850000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2348285556.0000000003857000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000002.2514043188.0000000000755000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2352554152.0000000003857000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2352080361.0000000003858000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3615580090.0000021AF8330000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3615139686.0000021AF82F7000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.3018690212.0000021AF8330000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixel.gif?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&version=fa.1092c&evt_src=fa_
Source: Setup.exe, 00000000.00000003.2021965125.0000000002AEF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixel.gif?guid=stallation?&version=ones
Source: chrome.exe, 00000001.00000002.3639235216.0000247C00A70000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.php
Source: chrome.exe, 00000001.00000002.3647181762.0000247C01244000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.phpade
Source: chrome.exe, 00000001.00000002.3647181762.0000247C01244000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.phpds$
Source: Setup.exe, 00000000.00000002.2023756429.00000000005BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/privacy.html?guid=welhttps://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_min
Source: chrome.exe, 00000001.00000002.3652102323.0000247C01B8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/ta
Source: Setup.exe, 00000000.00000002.2023756429.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000002.2514043188.0000000000731000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/tos.html?guid=
Source: chrome.exe, 00000001.00000002.3640392857.0000247C00B92000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3640296376.0000247C00B80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store1
Source: chrome.exe, 00000001.00000002.3636850776.0000247C007C8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store:443
Source: chrome.exe, 00000001.00000002.3631539648.0000247C0015C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000001.00000002.3633727510.0000247C003B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeAccess-Coro
Source: chrome.exe, 00000001.00000002.3653790485.0000247C01D74000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeDate:
Source: chrome.exe, 00000001.00000002.3646911036.0000247C01221000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3626770724.000002655C557000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3651890422.0000247C01B6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeH
Source: chrome.exe, 00000001.00000002.3639824490.0000247C00B28000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeHX
Source: chrome.exe, 00000001.00000002.3630976565.0000247C000B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win6
Source: chrome.exe, 00000001.00000002.3652172672.0000247C01B9C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.c
Source: chrome.exe, 00000001.00000002.3640392857.0000247C00B92000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_windows_icon.svg
Source: chrome.exe, 00000001.00000002.3630506082.0000247C00064000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000001.00000002.3638603957.0000247C009E8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000001.00000002.3653074847.0000247C01C30000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubl
Source: chrome.exe, 00000001.00000002.3640392857.0000247C00B92000.00000004.00000001.00020000.00000000.sdmp, chromecache_286.3.drString found in binary or memory: https://td.doubleclick.net
Source: chrome.exe, 00000001.00000002.3638540882.0000247C009DC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3648323304.0000247C01464000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3648857119.0000247C014EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/
Source: chrome.exe, 00000001.00000002.3651739530.0000247C01B40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3648857119.0000247C014EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/bjs
Source: chrome.exe, 00000001.00000002.3651739530.0000247C01B40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2522728324.0000247C01A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3651215485.0000247C01A94000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3637961241.0000247C0091C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/bts
Source: chrome.exe, 00000001.00000002.3623017898.0000026558AE7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3644714654.0000247C01022000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3645406315.0000247C010B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3644062539.0000247C00FB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/ga/rul?tid=G-VFQWFX3X1C&gacid=189414535.1730914672&gtm=45je4au0v898645
Source: chrome.exe, 00000001.00000002.3623017898.0000026558AE7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3649489759.0000247C015E4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/rul/858128210?random=1730914671161&cv=11&fst=1730914671161&fmt=3&bg=ff
Source: chrome.exe, 00000001.00000002.3623182942.0000026558B17000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3650323523.0000247C018EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3637961241.0000247C0091C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3649489759.0000247C015E4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/rul/858128210?random=1730914671189&cv=11&fst=1730914671189&fmt=3&bg=ff
Source: chrome.exe, 00000001.00000002.3653074847.0000247C01C30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3649489759.0000247C015E4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/rul/858128210?random=1730914671204&cv=11&fst=1730914671204&fmt=3&bg=ff
Source: chrome.exe, 00000001.00000002.3651739530.0000247C01B40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/update?ig_name=4s1768241791.1730914671
Source: chrome.exe, 00000001.00000002.3654231424.0000247C01E59000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net4s1768241791.1730914671
Source: chrome.exe, 00000001.00000002.3654231424.0000247C01E59000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net4s1768241791.1730914671/
Source: chrome.exe, 00000001.00000002.3641857260.0000247C00CAC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.neter.comccoofpliimaahmaaome
Source: chrome.exe, 00000001.00000003.2522728324.0000247C01A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3651215485.0000247C01A94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.nethttps://pcapp.store
Source: chrome.exe, 00000001.00000003.2522728324.0000247C01A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3651215485.0000247C01A94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.nethttps://pcapp.store/
Source: chrome.exe, 00000001.00000002.3651739530.0000247C01B40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doublec
Source: chrome.exe, 00000001.00000002.3637961241.0000247C0091C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258
Source: chrome.exe, 00000001.00000003.2522728324.0000247C01A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3651215485.0000247C01A94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&
Source: chrome.exe, 00000001.00000002.3651215485.0000247C01A94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&cr_id=681164326060&cv_id=1&format=$
Source: chrome.exe, 00000001.00000002.3651215485.0000247C01A94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&cr_id=681210400247&cv_id=2&format=$
Source: chrome.exe, 00000001.00000002.3651215485.0000247C01A94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&cr_id=682239234212&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820411&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820414&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820429&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820432&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820444&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820450&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820453&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820456&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688795175019&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688917203998&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3653709434.0000247C01D54000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://update.googleapis.com/service/update2/json
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://update.googleapis.com/service/update2/json?cup2key=13:Ie66yaGi2bQEn5_v3xugblomRluL_Zwyn4M6qI
Source: chrome.exe, 00000001.00000002.3653627396.0000247C01CAC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ww.googletagmanager.com
Source: chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000001.00000002.3640225220.0000247C00B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2469395455.0000247C00B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000001.00000002.3640225220.0000247C00B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2469395455.0000247C00B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000001.00000002.3640225220.0000247C00B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2469395455.0000247C00B60000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000001.00000002.3635557190.0000247C0067C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3635311998.0000247C0062C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000001.00000002.3638145484.0000247C00950000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3636850776.0000247C007C8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000001.00000002.3638145484.0000247C00950000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3636850776.0000247C007C8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTg
Source: chrome.exe, 00000001.00000002.3634243225.0000247C004D8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_thi
Source: chrome.exe, 00000001.00000002.3649283903.0000247C01568000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmpp
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcn
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnk
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/adb2qwdrzgsbze5reot2ljihgpqa_9275/hfnkpimlhhgiea
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/adohe7tf6ytr4v66tjma7zsnb3wq_1123/efniojlnjndmcb
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/ee
Source: chrome.exe, 00000001.00000002.3636593722.0000247C00784000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocnca
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabj
Source: chrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3638397742.0000247C00998000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindg
Source: chrome.exe, 00000001.00000002.3635557190.0000247C0067C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkh
Source: chrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/kuv6sxh4r3bgt6ctayzn6cl44e_3049/jflookgnkcckhoba
Source: chrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkke
Source: chrome.exe, 00000001.00000002.3639751766.0000247C00B0C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3636655492.0000247C0078C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3634420685.0000247C00514000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3634971015.0000247C005E8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000001.00000002.3654152780.0000247C01E28000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/pagead/1p-user-list/858128210/?random=1730914671161&cv=11&fst=1730912400000&b
Source: chrome.exe, 00000001.00000002.3649489759.0000247C015E4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/pagead/1p-user-list/858128210/?random=1730914671189&cv=11&fst=1730912400000&b
Source: chrome.exe, 00000001.00000002.3633564470.0000247C00390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000001.00000002.3633564470.0000247C00390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit$
Source: chrome.exe, 00000001.00000002.3624960382.00000265592AD000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: chrome.exe, 00000001.00000002.3630235172.0000247C0000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000001.00000002.3632238499.0000247C0020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000001.00000002.3646911036.0000247C01221000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3626770724.000002655C557000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3651890422.0000247C01B6C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3639824490.0000247C00B28000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3646128007.0000247C01134000.00000004.00000001.00020000.00000000.sdmp, chromecache_286.3.drString found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000001.00000002.3640296376.0000247C00B80000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3649351288.0000247C01588000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/
Source: chrome.exe, 00000001.00000002.3623182942.0000026558B17000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3638397742.0000247C00998000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=AW-858128210
Source: chrome.exe, 00000001.00000002.3635491525.0000247C00660000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3638397742.0000247C00998000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C
Source: chrome.exe, 00000001.00000002.3635624317.0000247C00694000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C&l=dataLayer&cx=c
Source: chrome.exe, 00000001.00000002.3626770724.000002655C557000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3651215485.0000247C01A94000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3631539648.0000247C0015C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3653470026.0000247C01C94000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3645990350.0000247C01110000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3652172672.0000247C01B9C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3640296376.0000247C00B80000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3646128007.0000247C01134000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.store
Source: chrome.exe, 00000001.00000002.3631539648.0000247C0015C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storeHX
Source: chrome.exe, 00000001.00000002.3646293081.0000247C01174000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2522728324.0000247C01A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3645990350.0000247C01110000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storepp
Source: chrome.exe, 00000001.00000003.2522728324.0000247C01A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3651215485.0000247C01A94000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storeto
Source: chrome.exe, 00000001.00000002.3653074847.0000247C01C30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3640296376.0000247C00B80000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3643170364.0000247C00ED4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3646128007.0000247C01134000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3645103667.0000247C0105C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fpcap
Source: chrome.exe, 00000001.00000002.3634243225.0000247C004D8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3644960803.0000247C01030000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000001.00000002.3643239275.0000247C00EF8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.jsdelivr.com/using-sri-with-dynamic-files
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3632853098.0000247C002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_004056DE
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindows user hook set: 0 mouse low level C:\Users\user\PCAppStore\PcAppStore.exeJump to behavior
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040352D
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpCode function: 9_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,9_2_00403640
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040755C0_2_0040755C
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00406D850_2_00406D85
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpCode function: 9_2_00406D5F9_2_00406D5F
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CD127410_2_00007FF660CD1274
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660B095B010_2_00007FF660B095B0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CAC3D810_2_00007FF660CAC3D8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CAC75C10_2_00007FF660CAC75C
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CAAA5410_2_00007FF660CAAA54
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CD0BD810_2_00007FF660CD0BD8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CC2B9410_2_00007FF660CC2B94
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CAAC5810_2_00007FF660CAAC58
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660AE0F2010_2_00007FF660AE0F20
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CAAE6410_2_00007FF660CAAE64
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CCF00810_2_00007FF660CCF008
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CC0F4810_2_00007FF660CC0F48
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CAB06810_2_00007FF660CAB068
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CAB27410_2_00007FF660CAB274
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CC13DC10_2_00007FF660CC13DC
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CAB47810_2_00007FF660CAB478
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CB556010_2_00007FF660CB5560
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660C876A810_2_00007FF660C876A8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CAD98410_2_00007FF660CAD984
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CC1A5C10_2_00007FF660CC1A5C
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CADD8810_2_00007FF660CADD88
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CC00EC10_2_00007FF660CC00EC
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF72481DDDC11_2_00007FF72481DDDC
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF72480ED5011_2_00007FF72480ED50
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF724818EDC11_2_00007FF724818EDC
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF72481C7C411_2_00007FF72481C7C4
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF724819F2011_2_00007FF724819F20
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF72481175411_2_00007FF724811754
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF7248190E811_2_00007FF7248190E8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF72482285C11_2_00007FF72482285C
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF72481D94811_2_00007FF72481D948
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF724826AB811_2_00007FF724826AB8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF7248223C011_2_00007FF7248223C0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF72482033011_2_00007FF724820330
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF724818CD011_2_00007FF724818CD0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF72481E45C11_2_00007FF72481E45C
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\nsb5A9.tmp F42D2BF4A50AB0CDB4A1C43964F0429C4663E27C76D8C61AFA174A531A7819A1
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: String function: 00007FF660A9FCC0 appears 57 times
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: String function: 00007FF660A90F30 appears 102 times
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: String function: 00007FF660A911A0 appears 403 times
Source: NW_store.exe.9.drStatic PE information: Number of sections : 13 > 10
Source: nw.dll.9.drStatic PE information: Number of sections : 15 > 10
Source: vk_swiftshader.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: ffmpeg.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: vulkan-1.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: libEGL.dll.9.drStatic PE information: Number of sections : 12 > 10
Source: node.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: nw_elf.dll.9.drStatic PE information: Number of sections : 14 > 10
Source: libGLESv2.dll.9.drStatic PE information: Number of sections : 12 > 10
Source: notification_helper.exe.9.drStatic PE information: Number of sections : 13 > 10
Source: Setup.exe, 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameinetc.dllF vs Setup.exe
Source: Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal51.spyw.evad.winEXE@36/254@0/28
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660A98790 GetLastError,FormatMessageW,10_2_00007FF660A98790
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040352D
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpCode function: 9_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,9_2_00403640
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_0040498A
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF72480DBA0 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Concurrency::details::WorkQueue::IsStructuredEmpty,CloseHandle,Process32NextW,CloseHandle,11_2_00007FF72480DBA0
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_004021AA CoCreateInstance,0_2_004021AA
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660B31860 FindResourceW,LoadResource,LockResource,SizeofResource,GlobalAlloc,GlobalLock,GlobalUnlock,CreateStreamOnHGlobal,GetLastError,10_2_00007FF660B31860
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStoreJump to behavior
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsuE7DE.tmpJump to behavior
Source: Setup.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\Setup.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT sql FROM%d UNION ALL SELECT shell_add_schema(sql,mainNULL,name) AS sql, type, tbl_name, name, rowid, AS snum, AS sname FROM .sqlite_schema UNION ALL SELECT shell_module_schema(name), 'table', name, name, name, 9e+99, 'main' FROM pragma_module_list) WHERE %Qlower(printf('%s.%s',sname,tbl_name))lower(tbl_name) GLOB LIKE ESCAPE '\' AND name NOT LIKE 'sqlite_%%' AND sql IS NOT NULL ORDER BY snum, rowidSQL: %s;
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');%s
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT max(length(key)) FROM temp.sqlite_parameters;
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: CREATE TABLE ColNames( cpos INTEGER PRIMARY KEY, name TEXT, nlen INT, chop INT, reps INT, suff TEXT);CREATE VIEW RepeatedNames AS SELECT DISTINCT t.name FROM ColNames t WHERE t.name COLLATE NOCASE IN ( SELECT o.name FROM ColNames o WHERE o.cpos<>t.cpos);
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT type,name,tbl_name,sql FROM sqlite_schema ORDER BY name;
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT key, quote(value) FROM temp.sqlite_parameters;
Source: chrome.exe, 00000001.00000002.3633629979.0000247C003AF000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT 'CREATE TEMP' || substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO selftest(tno,op,cmd,ans) SELECT rowid*10,op,cmd,ans FROM [_shell$self];
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;Warning: cannot step "%s" backwardsSELECT name, sql FROM sqlite_schema WHERE %sError: (%d) %s on [%s]
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT tbl,idx,stat FROM sqlite_stat1 ORDER BY tbl,idx;
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT 'EXPLAIN QUERY PLAN SELECT 1 FROM ' || quote(s.name) || ' WHERE ' || group_concat(quote(s.name) || '.' || quote(f.[from]) || '=?' || fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]),' AND '), 'SEARCH ' || s.name || ' USING COVERING INDEX*(' || group_concat('*=?', ' AND ') || ')', s.name || '(' || group_concat(f.[from], ', ') || ')', f.[table] || '(' || group_concat(COALESCE(f.[to], p.[name])) || ')', 'CREATE INDEX ' || quote(s.name ||'_'|| group_concat(f.[from], '_')) || ' ON ' || quote(s.name) || '(' || group_concat(quote(f.[from]) || fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]), ', ') || ');', f.[table] FROM sqlite_schema AS s, pragma_foreign_key_list(s.name) AS f LEFT JOIN pragma_table_info AS p ON (pk-1=seq AND p.arg=f.[table]) GROUP BY s.name, f.id ORDER BY (CASE WHEN ? THEN f.[table] ELSE s.name END)
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT 'CREATE TEMP' || substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;ALTER TABLE temp.%Q RENAME TO %QINSERT INTO %Q VALUES(, %s?)UPDATE %Q SET , %s%Q=?DELETE FROM %QSELECT type, name, sql, 1 FROM sqlite_schema WHERE type IN ('table','view') AND name NOT LIKE 'sqlite_%%' UNION ALL SELECT type, name, sql, 2 FROM sqlite_schema WHERE type = 'trigger' AND tbl_name IN(SELECT name FROM sqlite_schema WHERE type = 'view') ORDER BY 4, 1CREATE TABLE x(, %s%Q COLLATE %s)CREATE VIRTUAL TABLE %Q USING expert(%Q)SELECT max(i.seqno) FROM sqlite_schema AS s, pragma_index_list(s.name) AS l, pragma_index_info(l.name) AS i WHERE s.type = 'table', %sx.%Q IS rem(%d, x.%Q) COLLATE %s%s%dSELECT %s FROM %Q x ORDER BY %sSELECT %s FROM temp.t592690916721053953805701627921227776 x ORDER BY %s%d %dDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776CREATE TABLE temp.t592690916721053953805701627921227776 AS SELECT * FROM %QSELECT s.rowid, s.name, l.name FROM sqlite_schema AS s, pragma_index_list(s.name) AS l WHERE s.type = 'table'SELECT name, coll FROM pragma_index_xinfo(?) WHERE keyINSERT INTO sqlite_stat1 VALUES(?, ?, ?)ANALYZE; PRAGMA writable_schema=1remsampleDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776ANALYZE sqlite_schemaDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776:memory::memory:SELECT sql FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%%' AND sql NOT LIKE 'CREATE VIRTUAL %%'Cannot find a unique index name to propose. -- stat1: %s;%s%s
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT OR IGNORE INTO "%s" VALUES(?,?);Error %d: %s on [%s]
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379845647.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474775952.00007FF660D32000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485956205.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT name,seq FROM sqlite_sequence ORDER BY name;
Source: C:\Users\user\Desktop\Setup.exeFile read: C:\Users\user\Desktop\Setup.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241106123744.238&_fcid=1730911513052455
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2008,i,3825837893827184749,16738686684280894307,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4880 --field-trial-handle=2008,i,3825837893827184749,16738686684280894307,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=2008,i,3825837893827184749,16738686684280894307,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsb5A9.tmp "C:\Users\user\AppData\Local\Temp\nsb5A9.tmp" /internal 1730911513052455 /force
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpProcess created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241106123843.1985957453 /ver=fa.1092c
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241106123744.238&_fcid=1730911513052455Jump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsb5A9.tmp "C:\Users\user\AppData\Local\Temp\nsb5A9.tmp" /internal 1730911513052455 /forceJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2008,i,3825837893827184749,16738686684280894307,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4880 --field-trial-handle=2008,i,3825837893827184749,16738686684280894307,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=2008,i,3825837893827184749,16738686684280894307,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpProcess created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241106123843.1985957453 /ver=fa.1092cJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\Setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.shell.servicehostbuilder.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ieframe.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mlang.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wlanapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uiamanager.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: twinapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.shell.servicehostbuilder.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: apphelp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: urlmon.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: winhttp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: iertutil.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: srvcli.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: netutils.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: windows.storage.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: wldp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: uxtheme.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: wininet.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: sspicli.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: profapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: mswsock.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: winnsi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: dnsapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: schannel.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ntasn1.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: msasn1.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: dpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: cryptsp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: rsaenh.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: cryptbase.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: gpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ncrypt.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ncryptsslp.dll
Source: C:\Windows\explorer.exeSection loaded: cdprt.dll
Source: C:\Windows\explorer.exeSection loaded: smartscreenps.dll
Source: C:\Windows\explorer.exeSection loaded: provsvc.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dll
Source: C:\Windows\explorer.exeSection loaded: msvcp140.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dll
Source: C:\Windows\explorer.exeSection loaded: capabilityaccessmanagerclient.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: urlmon.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: version.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wlanapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winhttp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dwmapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: secur32.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iertutil.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: srvcli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: netutils.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: profapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sspicli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: amsi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: userenv.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeSection loaded: oleacc.dll
Source: C:\Users\user\Desktop\Setup.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: PC App Store.lnk.9.drLNK file: ..\..\..\..\..\..\PCAppStore\PcAppStore.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStoreJump to behavior
Source: Setup.exeStatic PE information: certificate valid
Source: Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\Watchdog\x64\Release\Watchdog.pdb source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002742000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000002.3611553135.00007FF72482A000.00000002.00000001.01000000.00000017.sdmp, Watchdog.exe, 0000000B.00000000.2380188478.00007FF72482A000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb1 source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: UywbCAwwkazz.exe, 0000000E.00000000.2461479322.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000010.00000000.2470847783.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000011.00000002.3602292721.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000013.00000000.2481831021.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000014.00000000.2484863666.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000015.00000000.2488700201.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000017.00000002.3593700127.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000018.00000000.2498642452.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000019.00000000.2501045248.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000001A.00000002.3606688438.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000001B.00000002.3600980074.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000001C.00000000.2511399795.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000001D.00000000.2513190038.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000001E.00000000.2519484654.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000001F.00000002.3593648901.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000020.00000000.2521981223.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000021.00000002.3600017993.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000022.00000000.2524130677.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000023.00000000.2525620978.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000024.00000002.3596382368.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000025.00000002.3594038349.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000026.00000000.2533281250.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000027.00000000.2535912290.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000028.00000000.2538197974.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 00000029.00000002.3593590447.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000002A.00000000.2547219620.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000002B.00000002.3593590015.00000000006DE000.00000002.00000001.01000000.00000019.sdmp, UywbCAwwkazz.exe, 0000002C.00000000.2549893132.00000
Source: Binary string: C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb source: Setup.exe, 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\engine\Release\PCAppStore.pdb source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379707256.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000000.2474734373.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000012.00000002.2485846201.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660AEBFE0 atomic,atomic,LoadLibraryW,GetProcAddress,atomic,atomic,type_info::_name_internal_method,Concurrency::details::WorkQueue::IsStructuredEmpty,LoadLibraryW,Concurrency::details::_Scheduler::_Scheduler,GetProcAddress,atomic,10_2_00007FF660AEBFE0
Source: Setup.exeStatic PE information: real checksum: 0x3937f should be: 0x33317
Source: NW_store.exe.9.drStatic PE information: real checksum: 0x0 should be: 0x23ab08
Source: System.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x3d68
Source: System.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x3d68
Source: vk_swiftshader.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x44caa7
Source: ffmpeg.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x1f8136
Source: nsJSON.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x6718
Source: NSISFastLib.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x30512
Source: inetc.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x13c41
Source: vulkan-1.dll.9.drStatic PE information: real checksum: 0x0 should be: 0xe0b14
Source: libEGL.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x7ddc6
Source: nsJSON.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x6718
Source: Math.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x155a8
Source: nw_elf.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x124d11
Source: NSISFastLib.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x30512
Source: inetc.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x13c41
Source: libGLESv2.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x7b9652
Source: notification_helper.exe.9.drStatic PE information: real checksum: 0x0 should be: 0x11edb8
Source: nsDialogs.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x2f9b
Source: NW_store.exe.9.drStatic PE information: section name: .gxfg
Source: NW_store.exe.9.drStatic PE information: section name: .retplne
Source: NW_store.exe.9.drStatic PE information: section name: .voltbl
Source: NW_store.exe.9.drStatic PE information: section name: CPADinfo
Source: NW_store.exe.9.drStatic PE information: section name: _RDATA
Source: NW_store.exe.9.drStatic PE information: section name: malloc_h
Source: ffmpeg.dll.9.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.9.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.9.drStatic PE information: section name: .voltbl
Source: ffmpeg.dll.9.drStatic PE information: section name: _RDATA
Source: libEGL.dll.9.drStatic PE information: section name: .gxfg
Source: libEGL.dll.9.drStatic PE information: section name: .retplne
Source: libEGL.dll.9.drStatic PE information: section name: .voltbl
Source: libEGL.dll.9.drStatic PE information: section name: _RDATA
Source: libEGL.dll.9.drStatic PE information: section name: malloc_h
Source: libGLESv2.dll.9.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.9.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.9.drStatic PE information: section name: .voltbl
Source: libGLESv2.dll.9.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.9.drStatic PE information: section name: malloc_h
Source: node.dll.9.drStatic PE information: section name: .gxfg
Source: node.dll.9.drStatic PE information: section name: .retplne
Source: node.dll.9.drStatic PE information: section name: .voltbl
Source: node.dll.9.drStatic PE information: section name: _RDATA
Source: notification_helper.exe.9.drStatic PE information: section name: .gxfg
Source: notification_helper.exe.9.drStatic PE information: section name: .retplne
Source: notification_helper.exe.9.drStatic PE information: section name: .voltbl
Source: notification_helper.exe.9.drStatic PE information: section name: CPADinfo
Source: notification_helper.exe.9.drStatic PE information: section name: _RDATA
Source: notification_helper.exe.9.drStatic PE information: section name: malloc_h
Source: nw.dll.9.drStatic PE information: section name: .gxfg
Source: nw.dll.9.drStatic PE information: section name: .retplne
Source: nw.dll.9.drStatic PE information: section name: .rodata
Source: nw.dll.9.drStatic PE information: section name: .voltbl
Source: nw.dll.9.drStatic PE information: section name: CPADinfo
Source: nw.dll.9.drStatic PE information: section name: LZMADEC
Source: nw.dll.9.drStatic PE information: section name: _RDATA
Source: nw.dll.9.drStatic PE information: section name: malloc_h
Source: nw_elf.dll.9.drStatic PE information: section name: .crthunk
Source: nw_elf.dll.9.drStatic PE information: section name: .gxfg
Source: nw_elf.dll.9.drStatic PE information: section name: .retplne
Source: nw_elf.dll.9.drStatic PE information: section name: .voltbl
Source: nw_elf.dll.9.drStatic PE information: section name: CPADinfo
Source: nw_elf.dll.9.drStatic PE information: section name: _RDATA
Source: nw_elf.dll.9.drStatic PE information: section name: malloc_h
Source: vk_swiftshader.dll.9.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.9.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.9.drStatic PE information: section name: .voltbl
Source: vk_swiftshader.dll.9.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.9.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.9.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.9.drStatic PE information: section name: .voltbl
Source: vulkan-1.dll.9.drStatic PE information: section name: _RDATA
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660AEF0B0 pushfq ; ret 10_2_00007FF660AEF0B1
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\Uninstaller.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\nwjs\nw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\AppData\Local\Temp\nse5976.tmp\Math.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\nwjs\ffmpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\nwjs\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\System.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\AppData\Local\Temp\nse5976.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\Watchdog.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\AppData\Local\Temp\nse5976.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\nwjs\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\nwjs\node.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\AppData\Local\Temp\nse5976.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\PcAppStore.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\AutoUpdater.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\nwjs\nw_elf.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\nwjs\libGLESv2.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\AppData\Local\Temp\nse5976.tmp\System.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txtJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\PCAppStore\ReadMe.txtJump to behavior

Boot Survival

barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdaterJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WatchdogJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStoreJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStoreJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStoreJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdaterJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdaterJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WatchdogJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WatchdogJump to behavior
Source: C:\Users\user\Desktop\Setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
Source: C:\Users\user\Desktop\Setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 300000
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: threadDelayed 362Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: threadDelayed 1480Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: threadDelayed 2005Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: foregroundWindowGot 1417Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\Uninstaller.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse5976.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\node.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse5976.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\AutoUpdater.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse5976.tmp\Math.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\System.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse5976.tmp\System.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libGLESv2.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse5976.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\PCAppStore\Watchdog.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 4584Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 7784Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 4584Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\PCAppStore\Watchdog.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C49
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00406873 FindFirstFileW,FindClose,0_2_00406873
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040290B FindFirstFileW,0_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpCode function: 9_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,9_2_00405D74
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpCode function: 9_2_0040699E FindFirstFileW,FindClose,9_2_0040699E
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpCode function: 9_2_0040290B FindFirstFileW,9_2_0040290B
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660C875F8 FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,10_2_00007FF660C875F8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660C876A8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,10_2_00007FF660C876A8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF7248116E0 FindClose,FindFirstFileExW,GetLastError,11_2_00007FF7248116E0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF724811754 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,11_2_00007FF724811754
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF724820330 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,11_2_00007FF724820330
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 60000
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 300000
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 60000
Source: explorer.exe, 0000000C.00000000.2402710750.00000000098A8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Setup.exe, 00000000.00000003.1732145450.0000000000660000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"_OSVGF","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"OXWABUVD+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29",
Source: chrome.exe, 00000001.00000002.3639450498.0000247C00ABC000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware
Source: PcAppStore.exe, 00000012.00000002.2484478148.0000024F2CBF7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductW6HLVM71434D56-1548-ED3D-AEE6-C75AECD93BF0VMware, Inc.None+
Source: chrome.exe, 00000001.00000002.3645990350.0000247C01110000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual USB Mouse
Source: explorer.exe, 0000000C.00000000.2385676516.0000000001248000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: Setup.exe, 00000000.00000003.1732145450.0000000000660000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gstem_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"_OSVGF","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"OXWABUVD+SCSI+Disk+Device",
Source: nsb5A9.tmp, 00000009.00000003.2512692026.000000000077B000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000002.2514328480.000000000077B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWf}%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 0000000C.00000000.2396965974.00000000079FB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: PcAppStore.exe, 00000012.00000002.2484478148.0000024F2CBD4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
Source: PcAppStore.exe, 0000000A.00000002.3613257732.0000021AF5C4C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWr0
Source: Setup.exe, 00000000.00000002.2024594620.0000000002A60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW97\0
Source: Setup.exe, 00000000.00000003.2022210053.0000000000696000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2023848065.0000000000696000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2024594620.0000000002A60000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000002.2514328480.000000000078C000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2512692026.000000000078C000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3613257732.0000021AF5D26000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000002.3600453798.000001985E9F7000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000002.3600453798.000001985E982000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3625445536.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2400856336.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2400856336.000000000982D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: tempPOSTData.9.drBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"_OSVGF","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"OXWABUVD+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"Memory+Compression","2":"OfficeClickToRun%2Eexe","3":"Registry","4":"RuntimeBroker%2Eexe","5":"SIHClient%2Eexe","6":"SearchApp%2Eexe","7":"SgrmBroker%2Eexe","8":"StartMenuExperienceHost%2Eexe","9":"System","10":"SystemSettings%2Eexe","11":"TextInputHost%2Eexe","12":"UserOOBEBroker%2Eexe","13":"UywbCAwwkazz%2Eexe","14":"WinStore%2EApp%2Eexe","15":"WmiPrvSE%2Eexe","16":"%5BSystem+Process%5D","17":"audiodg%2Eexe","18":"chrome%2Eexe","19":"conhost%2Eexe","20":"csrss%2Eexe","21":"ctfmon%2Eexe","22":"dasHost%2Eexe","23":"dllhost%2Eexe","24":"dwm%2Eexe","25":"explorer%2Eexe","26":"fontdrvhost%2Eexe","27":"lsass%2Eexe","28":"nsb5A9%2Etmp","29":"services%2Eexe","30":"sihost%2Eexe","31":"smartscreen%2Eexe","32":"smss%2Eexe","33":"spoolsv%2Eexe","34":"svchost%2Eexe","35":"wininit%2Eexe","36":"winlogon%2Eexe"}}
Source: nsb5A9.tmp, 00000009.00000003.2512692026.000000000078C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware%2C+Inc%2E
Source: nsb5A9.tmp, 00000009.00000003.2512692026.000000000078C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.N8X
Source: Setup.exe, 00000000.00000003.1732883470.0000000000658000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "pc_vendor":"VMware%2C+Inc%2E",
Source: PcAppStore.exe, 0000000A.00000002.3615139686.0000021AF82E0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}u
Source: explorer.exe, 0000000C.00000002.3627594018.0000000009977000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Setup.exe, 00000000.00000003.1732883470.0000000000660000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: fstem_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"_OSVGF","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"OXWABUVD+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"Memory+Compression","2":"OfficeClickToRun%2Eexe","3":"Registry",
Source: chrome.exe, 00000001.00000003.2469395455.0000247C00B60000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=54c08d8d-3a07-4ab0-92ff-1e7b254b998c$|
Source: chrome.exe, 00000001.00000003.2469395455.0000247C00B60000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=54c08d8d-3a07-4ab0-92ff-1e7b254b998c
Source: chrome.exe, 00000001.00000002.3619216444.0000026554BFB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 00000012.00000002.2484478148.0000024F2CBE4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PcAppStore.exe, 0000000A.00000003.3018690212.0000021AF8330000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: explorer.exe, 0000000C.00000000.2400856336.0000000009815000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 0000000C.00000002.3618420513.00000000078A0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 0000000C.00000003.3104897384.000000000C9FC000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000C.00000000.2402710750.00000000098A8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000C.00000002.3620769598.00000000079FB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: nsb5A9.tmp, 00000009.00000003.2353339329.000000000389B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: LstringVMware, Inc.4
Source: explorer.exe, 0000000C.00000002.3627594018.0000000009977000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
Source: Watchdog.exe, 0000000B.00000002.3600453798.000001985E982000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWP
Source: explorer.exe, 0000000C.00000000.2396965974.00000000078AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTTAVMWare
Source: Setup.exe, 00000000.00000003.1732883470.0000000000660000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stem_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"_OSVGF","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"OXWABUVD+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"Memory+Compression","2":"OfficeClickToRun%2Eexe","3":"Registry","4":"RuntimeBroker%2Eexe","5":"SearchApp%2Eexe","6":"Setup%2Eexe","7":"SgrmBroker%2Eexe","8":"StartMenuExperienceHost%2Eexe","9":"System","10":"SystemSettings%2Eexe","11":"TextInputHost%2Eexe","12":"UserOOBEBroker%2Eexe","13":"UywbCAwwkazz%2Eexe","14":"WinStore%2EApp%2Eexe","15":"WmiPrvSE%2Eexe","16":"%5BSystem+Process%5D","17":"audiodg%2Eexe","18":"backgroundTaskHost%2Eexe","19":"conhost%2Eexe","20":"csrss%2Eexe","21":"ctfmon%2Eexe","22":"dasHost%2Eexe","23":"dllhost%2Eexe","24":"dwm%2Eexe","25":"explorer%2Eexe",
Source: explorer.exe, 0000000C.00000000.2400856336.0000000009815000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: Setup.exe, 00000000.00000003.1732540427.0000000000660000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"_OSVGF","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"OXWABUVD+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"Memory+Compression","2":"OfficeClickToRun%2Eexe","3":"Registry","4":"RuntimeBroker%2Eexe","5":"SearchApp%2Eexe","6":"Setup%2Eexe","7":"SgrmBroker%2Eexe","8":"StartMenuExperienceHost%2Eexe","9":"System","10":"SystemSettings%2Eexe","11":"TextInputHost%2Eexe","12":"UserOOBEBroker%2Eexe",
Source: Setup.exe, 00000000.00000002.2024594620.0000000002A60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,"cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"_OSVGF","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"OXWABUVD+SCSI+Disk+Device","disk_size":"412
Source: Setup.exe, 00000000.00000002.2023848065.0000000000638000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware%2C+Inc%2E]
Source: Setup.exe, 00000000.00000003.1732145450.000000000064F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware%2C+Inc%2E"
Source: PcAppStore.exe, 00000012.00000002.2484478148.0000024F2CBD4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductW6HLVM71434D56-1548-ED3D-AEE6-C75AECD93BF0VMware, Inc.Noney*
Source: explorer.exe, 0000000C.00000002.3620769598.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2396965974.0000000007A34000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 0000000C.00000000.2385676516.0000000001248000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 0000000C.00000002.3625445536.0000000009660000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: Setup.exe, 00000000.00000003.1732540427.0000000000660000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gstem_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"_OSVGF","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"OXWABUVD+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"Memory+Compression","2":"OfficeClickToRun%2Eexe","3":"Registry",
Source: explorer.exe, 0000000C.00000000.2385676516.0000000001248000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\Desktop\Setup.exeAPI call chain: ExitProcess graph end nodegraph_0-3503
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpAPI call chain: ExitProcess graph end nodegraph_9-3481
Source: C:\Users\user\Desktop\Setup.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CA8CB8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00007FF660CA8CB8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660C81254 __vcrt_InitializeCriticalSectionEx,GetLastError,IsDebuggerPresent,OutputDebugStringW,10_2_00007FF660C81254
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660AEBFE0 atomic,atomic,LoadLibraryW,GetProcAddress,atomic,atomic,type_info::_name_internal_method,Concurrency::details::WorkQueue::IsStructuredEmpty,LoadLibraryW,Concurrency::details::_Scheduler::_Scheduler,GetProcAddress,atomic,10_2_00007FF660AEBFE0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660A9A620 GetProcessHeap,10_2_00007FF660A9A620
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CA8CB8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00007FF660CA8CB8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CA3990 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_00007FF660CA3990
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF72481255C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,11_2_00007FF72481255C
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF724817EA8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_00007FF724817EA8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF724812FDC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_00007FF724812FDC
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF7248131C0 SetUnhandledExceptionFilter,11_2_00007FF7248131C0

HIPS / PFW / Operating System Protection Evasion

barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtOpenKeyEx: Direct from: 0x76F02B9C
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtOpenKeyEx: Direct from: 0x76F03C9C
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtReadVirtualMemory: Direct from: 0x76F02E8C
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtProtectVirtualMemory: Direct from: 0x76F02F9C
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtSetInformationProcess: Direct from: 0x76F02C5C
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtQueryAttributesFile: Direct from: 0x76F02E6C
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtCreateMutant: Direct from: 0x76F035CC
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtMapViewOfSection: Direct from: 0x76F02D1C
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtQueryVolumeInformationFile: Direct from: 0x76F02F2C
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtOpenSection: Direct from: 0x76F02E0C
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtDeviceIoControlFile: Direct from: 0x76F02AEC
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtAllocateVirtualMemory: Direct from: 0x76F02BFC
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtQueryValueKey: Direct from: 0x76F02BEC
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtAddAtomEx: Direct from: 0x76F0312C
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtCreateFile: Direct from: 0x76F02FEC
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtOpenFile: Direct from: 0x76F02DCC
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtSetInformationThread: Direct from: 0x76F02ECC
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtTerminateThread: Direct from: 0x76F02FCC
Source: C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exeNtQueryInformationProcess: Direct from: 0x76F02C26
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660B15130 keybd_event,keybd_event,10_2_00007FF660B15130
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241106123744.238&_fcid=1730911513052455Jump to behavior
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379707256.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: C++/WinRT version:2.0.220110.5productr_binErreCode=%dproductcreate_shortcutshortcut_erroroid=%luSHGetFolderPath_error_code=%X&oid=%luQueryInterface_error_code=%X&oid=%luCoCreateInstance_error_code=%X&oid=%lu.lnknfinityan.lnkindsnanproductshortcut_delete_erroreC=%XnfinityanindsnanShell_TrayWnd0p+00p+0unknowninfnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)unknownLTRRTLLTRinfnan(ind)nannan(snan)infnan(ind)nannan(snan)type must be string, but is type must be number, but is type must be number, but is \\\HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_CONFIGCurrentBuildBuildNumberSOFTWARE\Microsoft\Windows NT\CurrentVersionSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon%lu%02X\/Software\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunSoftware\PCAppStoreAppParamdefaultauto_start_oncontextual_offersperiodical_offerspersonilized_notifications%us%5B%5D=\uparamsnametype must be string, but is paramsnameurloidentryAppfilePath0e+000e+00RoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll^(https?://(?:www.)?([^/]+))(/.*)?$.dllDllGetActivationFactoryURL format is not valid : %wsWinHTTP 1.0handle initialization failuretimeout init failurehandle connection failureGEThandle request creation failurehandle request or response failurefile creation failurequery data not availableurloidlastTimeoTypesessionIdtagretmessageRoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll.dllDllGetActivationFactoryiconnamepathoidanimationsoundmenu_storemenu_searchhttps://pcapp.storenamepathmicrosoftIdregpathkeydisplaycountblinkingnotificationIconrunParampathalt_linkmicrosoftIdregpathkeyidwinGetParamsaltActionaltActionParamsid
Source: chrome.exe, 00000001.00000002.3620687130.0000026555661000.00000002.00000001.00040000.00000000.sdmp, PcAppStore.exe, explorer.exe, 0000000C.00000002.3625445536.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3605929957.00000000018A1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379707256.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: productui_creation_failedcreation_error=%wsui_termination_errordirectory_switching_error.\nwjs\NW_store.exe.\ui\.ENDING_EVT_HANDLERWindows Default Lock ScreenLocalPCAppStore\productsystem_eventmsg=shutdownshutdownproductsystem_eventmsg=logofflogoff{"app":{"menu_search":{"search_request":"", "page":"b"},"show_window": "menu_search"}}ClosingEventproducttaskbar_handler_erroreCode=%luShell_TrayWndStartTrayDummySearchControlTrayButton
Source: chrome.exe, 00000001.00000002.3620687130.0000026555661000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.3605929957.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2386403297.00000000018A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379707256.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: list too longStartMenuExperienceHost.exeShellExperienceHost.exeexplorer.exeSearchApp.exeSearchUI.exeSearchHost.exe{"app":{"menu_search":{"search_request":"", "page":"a", "top":%d,"left":%d,"bottom":%d,"right":%d},"show_window": "menu_search"}}{"app": {"hide_window": "menu_search"}}Shell_TrayWndStartTrayDummySearchControlTrayButton
Source: PcAppStore.exe, 0000000A.00000002.3613257732.0000021AF5C4C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerHEXT=.C
Source: PcAppStore.exe, 0000000A.00000003.2565441366.0000021AF8339000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.2565595387.0000021AF8355000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.2565501322.0000021AF8343000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndct
Source: explorer.exe, 0000000C.00000002.3595934304.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2385676516.0000000001248000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1Progman$
Source: chrome.exe, 00000001.00000002.3620687130.0000026555661000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.3605929957.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2386403297.00000000018A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
Source: chrome.exe, 00000001.00000002.3620687130.0000026555661000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.3605929957.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2386403297.00000000018A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379707256.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: TTaskbarShell_TrayWnd{"app": {"init":{"direction":"%c","screen_size":{"with_topbar":%d,"t":%d,"l":%d,"b":%d,"r":%d}}}}
Source: nsb5A9.tmp, 00000009.00000002.2514718880.0000000002B36000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2379707256.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: NWidgetShell_TrayWndTrayNotifyWnd+TrayButtonPNGArial++
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF7248267D0 cpuid 11_2_00007FF7248267D0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoEx,FormatMessageA,10_2_00007FF660C868B0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoEx,Concurrency::details::WorkQueue::IsStructuredEmpty,GetLocaleInfoEx,10_2_00007FF660B07BE0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: GetLocaleInfoEx,FormatMessageA,11_2_00007FF724811448
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF660CA3594 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,10_2_00007FF660CA3594
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040352D
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\nsb5A9.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\PCAppStore\PcAppStore.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesJump to behavior
Source: pt-PT.pak.info.9.drBinary or memory string: IDS_WIN_8_1_OBSOLETE,943,../../chrome/app/chromium_strings.grd
Source: pt-PT.pak.info.9.drBinary or memory string: IDS_WIN_XP_VISTA_OBSOLETE,940,../../chrome/app/chromium_strings.grd
Source: pt-PT.pak.info.9.drBinary or memory string: IDS_WIN_8_OBSOLETE,942,../../chrome/app/chromium_strings.grd
Source: pt-PT.pak.info.9.drBinary or memory string: IDS_WIN_7_OBSOLETE,941,../../chrome/app/chromium_strings.grd

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts141
Windows Management Instrumentation		1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Deobfuscate/Decode Files or Information		1
OS Credential Dumping		1
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts2
Native API		1
DLL Search Order Hijacking		1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Input Capture		2
File and Directory Discovery		Remote Desktop Protocol1
Data from Local System		1
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Windows Service		1
DLL Search Order Hijacking		2
Obfuscated Files or Information		Security Account Manager155
System Information Discovery		SMB/Windows Admin Shares1
Input Capture		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron111
Registry Run Keys / Startup Folder		1
Access Token Manipulation		1
DLL Side-Loading		NTDS1
Query Registry		Distributed Component Object Model1
Clipboard Data		Protocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
Windows Service		1
DLL Search Order Hijacking		LSA Secrets261
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts12
Process Injection		1
Masquerading		Cached Domain Credentials141
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items111
Registry Run Keys / Startup Folder		141
Virtualization/Sandbox Evasion		DCSync3
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Access Token Manipulation		Proc Filesystem1
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
Process Injection		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1550454 Sample: Setup.exe Startdate: 06/11/2024 Architecture: WINDOWS Score: 51 80 Multi AV Scanner detection for dropped file 2->80 82 Machine Learning detection for sample 2->82 9 Setup.exe 2 41 2->9         started        process3 dnsIp4 74 37.19.194.81 INTERTELECOMUA Ukraine 9->74 76 209.222.21.115 AS-CHOOPAUS United States 9->76 44 C:\Users\user\AppData\Local\...\inetc.dll, PE32 9->44 dropped 46 C:\Users\user\AppData\...46SISFastLib.dll, PE32 9->46 dropped 48 C:\Users\user\AppData\Local\Temp\nsb5A9.tmp, PE32 9->48 dropped 50 3 other files (none is malicious) 9->50 dropped 86 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 9->86 14 nsb5A9.tmp 11 252 9->14         started        18 chrome.exe 1 9->18         started        file5 signatures6 process7 dnsIp8 52 C:\Users\user\PCAppStore\nwjs\vulkan-1.dll, PE32+ 14->52 dropped 54 C:\Users\user\...\vk_swiftshader.dll, PE32+ 14->54 dropped 56 C:\Users\user\PCAppStore\nwjs\nw_elf.dll, PE32+ 14->56 dropped 58 17 other files (14 malicious) 14->58 dropped 88 Multi AV Scanner detection for dropped file 14->88 90 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->90 92 Creates multiple autostart registry keys 14->92 21 PcAppStore.exe 2 3 14->21         started        25 Watchdog.exe 14->25         started        60 192.168.2.4 unknown unknown 18->60 62 239.255.255.250 unknown Reserved 18->62 27 chrome.exe 18->27         started        29 chrome.exe 18->29         started        31 chrome.exe 6 18->31         started        file9 signatures10 process11 dnsIp12 64 147.182.211.77 BV-PUBLIC-ASNUS United States 21->64 84 Tries to harvest and steal browser information (history, passwords, etc) 21->84 33 UywbCAwwkazz.exe 21->33 injected 36 explorer.exe 21->36 injected 38 UywbCAwwkazz.exe 21->38 injected 40 26 other processes 21->40 66 18.173.205.117 MIT-GATEWAYSUS United States 25->66 68 207.211.211.26 NAVISITE-EAST-2US United States 27->68 70 142.250.184.228 GOOGLEUS United States 27->70 72 20 other IPs or domains 27->72 signatures13 process14 signatures15 78 Found direct / indirect Syscall (likely to bypass EDR) 33->78 42 PcAppStore.exe 36->42         started        process16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Setup.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\nsb5A9.tmp46%ReversingLabsWin32.PUA.Generic
C:\Users\user\AppData\Local\Temp\nse5976.tmp\Math.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse5976.tmp\NSISFastLib.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse5976.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse5976.tmp\inetc.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse5976.tmp\nsJSON.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\NSISFastLib.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\inetc.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\nsDialogs.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\nsJSON.dll0%ReversingLabs
C:\Users\user\PCAppStore\AutoUpdater.exe5%ReversingLabs
C:\Users\user\PCAppStore\PcAppStore.exe8%ReversingLabs
C:\Users\user\PCAppStore\Uninstaller.exe29%ReversingLabs
C:\Users\user\PCAppStore\Watchdog.exe5%ReversingLabs
C:\Users\user\PCAppStore\nwjs\NW_store.exe0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\ffmpeg.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\libEGL.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\libGLESv2.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\node.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\notification_helper.exe0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw_elf.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\vulkan-1.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://anglebug.com/7604%0%Avira URL Cloudsafe
http://anglebug.com/383230%Avira URL Cloudsafe
https://pcapp.storeHX0%Avira URL Cloudsafe
https://pcapp.storeH0%Avira URL Cloudsafe
http://anglebug.com/3498=0%Avira URL Cloudsafe
http://anglebug.com/8229V0%Avira URL Cloudsafe
https://pcapp.store$0%Avira URL Cloudsafe
https://delivery.pcapp.store/50%Avira URL Cloudsafe
https://pcapp.store10%Avira URL Cloudsafe
https://pcapp.storeDate:0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

NameMaliciousAntivirus DetectionReputation
https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092cfalse
    		high

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://anglebug.com/38323chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    https://csp.withgoogle.com/csp/download-dt/1Tog$chrome.exe, 00000001.00000002.3631760879.0000247C0018C000.00000004.00000001.00020000.00000000.sdmpfalse
      		high
      https://duckduckgo.com/chrome_newtabchrome.exe, 00000001.00000002.3637242096.0000247C0085C000.00000004.00000001.00020000.00000000.sdmpfalse
        		high
        https://mail.google.com/mail/?usp=installed_webappchrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3631196894.0000247C000EC000.00000004.00000001.00020000.00000000.sdmpfalse
          		high
          https://duckduckgo.com/ac/?q=chrome.exe, 00000001.00000002.3640225220.0000247C00B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2469395455.0000247C00B60000.00000004.00000001.00020000.00000000.sdmpfalse
            		high
            https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditingchrome.exe, 00000001.00000002.3630506082.0000247C00064000.00000004.00000001.00020000.00000000.sdmpfalse
              		high
              https://pcapp.store/api/api.php$chrome.exe, 00000001.00000002.3635624317.0000247C00694000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3645103667.0000247C0105C000.00000004.00000001.00020000.00000000.sdmpfalse
                		high
                https://pcapp.store/lp/appstore/img/favicon.icopHchrome.exe, 00000001.00000002.3650871477.0000247C01980000.00000004.00000001.00020000.00000000.sdmpfalse
                  		high
                  http://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjichrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpfalse
                    		high
                    http://dl.google.com/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkjdchrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmpfalse
                      		high
                      https://docs.google.com/document/Jchrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpfalse
                        		high
                        https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonechrome.exe, 00000001.00000002.3635624317.0000247C00694000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3637961241.0000247C0091C000.00000004.00000001.00020000.00000000.sdmpfalse
                          		high
                          http://anglebug.com/4633chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                            		high
                            https://anglebug.com/7382chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                              		high
                              https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control:chrome.exe, 00000001.00000002.3640530210.0000247C00BA0000.00000004.00000001.00020000.00000000.sdmpfalse
                                		high
                                https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0chrome.exe, 00000001.00000002.3653264804.0000247C01C5C000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		high
                                  https://delivery.pcapp.store/5Setup.exe, 00000000.00000002.2024704807.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2022720793.0000000002AD1000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=&evt_src=fa_mini_instaSetup.exe, 00000000.00000002.2023756429.00000000005BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://dns-tunnel-check.googlezip.net/connectchrome.exe, 00000001.00000002.3647313539.0000247C01318000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		high
                                      https://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpnchrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		high
                                        http://dl.google.com/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/obedchrome.exe, 00000001.00000002.3636593722.0000247C00784000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          https://docs.google.com/document/:chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		high
                                            https://dl.google.com/release2/chrome_component/kuv6sxh4r3bgt6ctayzn6cl44e_3049/jflookgnkcckhobaglndchrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		high
                                              https://anglebug.com/7604%chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://anglebug.com/7714chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high
                                                https://pcapp.store/p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=173091151305chrome.exe, 00000001.00000002.3645177744.0000247C01080000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://td.doubleclick.net/chrome.exe, 00000001.00000002.3638540882.0000247C009DC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3648323304.0000247C01464000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3648857119.0000247C014EC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://www.google.com/chrome/tips/chrome.exe, 00000001.00000002.3638145484.0000247C00950000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3636850776.0000247C007C8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanchrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://drive.google.com/?lfhs=2chrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://anglebug.com/6248chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://anglebug.com/6929chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://anglebug.com/5281chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://www.google.com/dl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14chrome.exe, 00000001.00000002.3636593722.0000247C00784000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://csp.withgoogle.com/csp/apps-themesnchrome.exe, 00000001.00000002.3632384425.0000247C0027C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://pcapp.store/tos.html?guid=Setup.exe, 00000000.00000002.2023756429.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000002.2514043188.0000000000731000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://www.youtube.com/?feature=ytcachrome.exe, 00000001.00000002.3636297222.0000247C00751000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://issuetracker.google.com/255411748chrome.exe, 00000001.00000002.3643918168.0000247C00F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://csp.withgoogle.com/csp/analytics-container-tag-servingCross-Origin-Resource-Policy:chrome.exe, 00000001.00000002.3639071855.0000247C00A48000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://www.google.com/tools/feedback/chrome/__submit$chrome.exe, 00000001.00000002.3633564470.0000247C00390000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://pcapp.store/pixelgif.phpchrome.exe, 00000001.00000002.3639235216.0000247C00A70000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://anglebug.com/7246chrome.exe, 00000001.00000002.3641008038.0000247C00C0C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://doubleclick.net/t/$chrome.exe, 00000001.00000002.3649623700.0000247C0160C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://anglebug.com/7369chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://anglebug.com/8229Vchrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      https://anglebug.com/7489chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://duckduckgo.com/?q=chrome.exe, 00000001.00000002.3640530210.0000247C00BA0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3635693052.0000247C006B0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeachrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://chrome.google.com/webstorechrome.exe, 00000001.00000002.3635557190.0000247C0067C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3630235172.0000247C0000C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://pcapp.stchrome.exe, 00000001.00000002.3650323523.0000247C018EC000.00000004.00000001.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3615580090.0000021AF8330000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.3018690212.0000021AF8330000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820456&cv_id=0&format=$chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppechrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3chrome.exe, 00000001.00000002.3649283903.0000247C01568000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://cdn.ecosia.org/assets/images/ico/favicon.icochrome.exe, 00000001.00000002.3640225220.0000247C00B60000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2469395455.0000247C00B60000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://pcapp.storechrome.exe, 00000001.00000002.3652596144.0000247C01BDC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3644714654.0000247C01022000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://anglebug.com/3498=chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          https://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjchrome.exe, 00000001.00000002.3631261800.0000247C000FC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3638397742.0000247C00998000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://www.google.com/dl/release2/chrome_component/kuv6sxh4r3bgt6ctayzn6cl44e_3049/jflookgnkcckhobagchrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://pcapp.store$chrome.exe, 00000001.00000002.3641857260.0000247C00CAC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              https://issuetracker.google.com/161903006chrome.exe, 00000001.00000002.3643918168.0000247C00F94000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=17309115130chrome.exe, 00000001.00000002.3649489759.0000247C015E4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3646128007.0000247C01134000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3645406315.0000247C010B4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://www.ecosia.org/newtab/chrome.exe, 00000001.00000002.3639682172.0000247C00AF8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbnfchrome.exe, 00000001.00000002.3636191841.0000247C00728000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://pcapp.store1chrome.exe, 00000001.00000002.3640392857.0000247C00B92000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3640296376.0000247C00B80000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                      • Avira URL Cloud: safe
                                                                                                                      		unknown
                                                                                                                      https://pcapp.store/chrome.exe, 00000001.00000002.3649489759.0000247C015E4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3638397742.0000247C00998000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3644714654.0000247C01022000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3645406315.0000247C010B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3634760636.0000247C005B0000.00000004.00000001.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000002.2514328480.000000000078C000.00000004.00000020.00020000.00000000.sdmp, nsb5A9.tmp, 00000009.00000003.2512692026.000000000078C000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.3018634210.0000021AF83BA000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.3018663231.0000021AF83C1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://dl.google.com/release2/chrome_component/adb2qwdrzgsbze5reot2ljihgpqa_9275/hfnkpimlhhgieaddgfechrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://duckduckgo.com/favicon.icochrome.exe, 00000001.00000002.3636655492.0000247C0078C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionschrome.exe, 00000001.00000002.3636655492.0000247C0078C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacychrome.exe, 00000001.00000002.3635624317.0000247C00694000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3637961241.0000247C0091C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0chrome.exe, 00000001.00000002.3635897933.0000247C006F8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_pchrome.exe, 00000001.00000002.3634243225.0000247C004D8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820411&cv_id=0&format=$chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://anglebug.com/3078chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://anglebug.com/7553chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://anglebug.com/5375chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://pcapp.storeHXchrome.exe, 00000001.00000002.3639824490.0000247C00B28000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                            		unknown
                                                                                                                                            https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820429&cv_id=0&format=$chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_pachrome.exe, 00000001.00000002.3634243225.0000247C004D8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://dl.google.com/release2/chrome_component/adohe7tf6ytr4v66tjma7zsnb3wq_1123/efniojlnjndmcbiieechrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://anglebug.com/5371chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://chrome.google.com/webstore?hl=en)chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://anglebug.com/4722chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://m.google.com/devicemanagement/data/apichrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://docs.google.com/presentation/u/0/create?usp=chrome_actionschrome.exe, 00000001.00000002.3636655492.0000247C0078C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://googletagmanager.com/cychrome.exe, 00000001.00000002.3648457861.0000247C014A0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820450&cv_id=0&format=$chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://anglebug.com/7556chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&cr_id=682239234212&cv_id=0&format=$chrome.exe, 00000001.00000002.3651215485.0000247C01A94000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://chromewebstore.google.com/chrome.exe, 00000001.00000002.3630235172.0000247C0000C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://pcapp.storeHchrome.exe, 00000001.00000002.3646911036.0000247C01221000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3626770724.000002655C557000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3651890422.0000247C01B6C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://pcapp.storeDate:chrome.exe, 00000001.00000002.3653790485.0000247C01D74000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://dl.google.com/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/obechrome.exe, 00000001.00000002.3636593722.0000247C00784000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://pcapp.store/P/cSetup.exe, 00000000.00000002.2024704807.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2022720793.0000000002AD1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://pcapp.store/LMEMHSetup.exe, 00000000.00000002.2024704807.0000000002AD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2022720793.0000000002AD1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://pcapp.store/privacy.html?guid=welhttps://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_minSetup.exe, 00000000.00000002.2023756429.00000000005BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://clients4.google.com/chrome-syncchrome.exe, 00000001.00000002.3632102239.0000247C001C4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820414&cv_id=0&format=$chrome.exe, 00000001.00000002.3654271375.0000247C01E64000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppchrome.exe, 00000001.00000002.3630506082.0000247C0007B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    http://anglebug.com/6692chrome.exe, 00000001.00000002.3640872209.0000247C00BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high

                                                                                                                                                                                      World Map of Contacted IPs

                                                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                                                      • 75% < No. of IPs

                                                                                                                                                                                      Public IPs

                                                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                      64.176.203.93
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		11022ALABANZA-BALTUSfalse
                                                                                                                                                                                      173.194.76.157
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.185.228
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.74.200
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      216.58.206.74
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      209.222.21.115
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		20473AS-CHOOPAUSfalse
                                                                                                                                                                                      173.194.76.84
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.185.200
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.185.168
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      147.182.211.77
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		27555BV-PUBLIC-ASNUSfalse
                                                                                                                                                                                      142.250.184.228
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      172.217.18.110
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.186.35
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      142.250.185.67
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      1.1.1.1
                                                                                                                                                                                      		unknownAustralia
                                                                                                                                                                                      		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                      216.239.32.181
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      216.58.206.67
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      195.181.170.18
                                                                                                                                                                                      		unknownUnited Kingdom
                                                                                                                                                                                      		60068CDN77GBfalse
                                                                                                                                                                                      142.250.185.238
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      172.217.18.2
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      216.58.206.46
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      239.255.255.250
                                                                                                                                                                                      		unknownReserved
                                                                                                                                                                                      		unknownunknownfalse
                                                                                                                                                                                      142.250.185.196
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      18.173.205.117
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		3MIT-GATEWAYSUSfalse
                                                                                                                                                                                      172.217.16.194
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                      37.19.194.81
                                                                                                                                                                                      		unknownUkraine
                                                                                                                                                                                      		31343INTERTELECOMUAfalse
                                                                                                                                                                                      207.211.211.26
                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                      		14135NAVISITE-EAST-2USfalse

                                                                                                                                                                                      Private

                                                                                                                                                                                      IP
                                                                                                                                                                                      192.168.2.4

                                                                                                                                                                                      General Information

                                                                                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                      Analysis ID:1550454
                                                                                                                                                                                      Start date and time:2024-11-06 18:36:41 +01:00
                                                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                                                      Overall analysis duration:0h 11m 32s
                                                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                                                      Report type:full
                                                                                                                                                                                      Cookbook file name:default.jbs
                                                                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                      Run name:Run with higher sleep bypass
                                                                                                                                                                                      Number of analysed new started processes analysed:16
                                                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                                                      Number of injected processes analysed:29
                                                                                                                                                                                      Technologies:
                                                                                                                                                                                      • HCA enabled
                                                                                                                                                                                      • EGA enabled
                                                                                                                                                                                      • AMSI enabled
                                                                                                                                                                                      Analysis Mode:default
                                                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                                                      Sample name:Setup.exe
                                                                                                                                                                                      Detection:MAL
                                                                                                                                                                                      Classification:mal51.spyw.evad.winEXE@36/254@0/28
                                                                                                                                                                                      EGA Information:
                                                                                                                                                                                      • Successful, ratio: 100%
                                                                                                                                                                                      HCA Information:
                                                                                                                                                                                      • Successful, ratio: 73%
                                                                                                                                                                                      • Number of executed functions: 198
                                                                                                                                                                                      • Number of non-executed functions: 136
                                                                                                                                                                                      Cookbook Comments:
                                                                                                                                                                                      • Found application associated with file extension: .exe
                                                                                                                                                                                      • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                                                                                                                      Warnings

                                                                                                                                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                      • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                      • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                      • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                      • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                                                                                      • VT rate limit hit for: Setup.exe

                                                                                                                                                                                      Simulations

                                                                                                                                                                                      Behavior and APIs

                                                                                                                                                                                      TimeTypeDescription
                                                                                                                                                                                      17:38:44AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PCAppStore "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
                                                                                                                                                                                      17:38:52AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater "C:\Users\user\PCAppStore\AutoUpdater.exe" /i
                                                                                                                                                                                      17:39:01AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Watchdog "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241106123843.1985957453 /ver=fa.1092c
                                                                                                                                                                                      17:39:09AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PCAppStore "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
                                                                                                                                                                                      17:39:17AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater "C:\Users\user\PCAppStore\AutoUpdater.exe" /i
                                                                                                                                                                                      17:39:26AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Watchdog "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241106123843.1985957453 /ver=fa.1092c

                                                                                                                                                                                      LLM Input / Output

                                                                                                                                                                                      InputOutput
                                                                                                                                                                                      URL: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092c Model: claude-3-haiku-20240307
                                                                                                                                                                                      ```json
{
  "contains_trigger_text": true,
  "trigger_text": "We're on it, hold on",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}
                                                                                                                                                                                      URL: Model: claude-3-5-sonnet-latest
                                                                                                                                                                                      {
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}
                                                                                                                                                                                      URL: URL: https://pcapp.store
                                                                                                                                                                                      URL: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092c Model: claude-3-haiku-20240307
                                                                                                                                                                                      ```json
{
  "brands": [
    "PC APP STORE"
  ]
}
                                                                                                                                                                                      URL: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092c Model: claude-3-haiku-20240307
                                                                                                                                                                                      ```json
{
  "contains_trigger_text": true,
  "trigger_text": "We're on it, hold on",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}
                                                                                                                                                                                      URL: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092c Model: claude-3-haiku-20240307
                                                                                                                                                                                      ```json
{
  "contains_trigger_text": true,
  "trigger_text": "Entering the Matrix",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}
                                                                                                                                                                                      URL: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092c Model: claude-3-haiku-20240307
                                                                                                                                                                                      ```json
{
  "brands": [
    "PC APP STORE"
  ]
}
                                                                                                                                                                                      URL: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092c Model: claude-3-haiku-20240307
                                                                                                                                                                                      ```json
{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}
```

The provided image appears to be a blank webpage with minimal content. There are no visible trigger phrases, prominent buttons or links, text input fields, PDF icons, CAPTCHAs, urgent text, or QR codes. The page does not contain any clear indicators that it is a landing page.
                                                                                                                                                                                      URL: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092c Model: claude-3-haiku-20240307
                                                                                                                                                                                      ```json
{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}
                                                                                                                                                                                      URL: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092c Model: claude-3-haiku-20240307
                                                                                                                                                                                      ```json
{
  "brands": [
    "PC APP STORE"
  ]
}
                                                                                                                                                                                      URL: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092c Model: claude-3-haiku-20240307
                                                                                                                                                                                      ```json
{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false
}
```

The provided image appears to be a blank webpage with minimal content. There are no visible trigger phrases, input fields, PDF icons, CAPTCHAs, urgent text, or QR codes that I can detect. The page seems to be a generic landing page without any clear indicators of potential malicious activity.
                                                                                                                                                                                      URL: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092c Model: claude-3-haiku-20240307
                                                                                                                                                                                      ```json
{
  "brands": [
    "PC APP STORE"
  ]
}
                                                                                                                                                                                      URL: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092c Model: claude-3-haiku-20240307
                                                                                                                                                                                      ```json
{
  "brands": [
    "PC APP STORE"
  ]
}
                                                                                                                                                                                      URL: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730911513052455&_winver=19045&version=fa.1092c Model: claude-3-haiku-20240307
                                                                                                                                                                                      ```json
{
  "brands": [
    "PC APP STORE"
  ]
}

                                                                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                                                                      IPs

                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                      64.176.203.93Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                        Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                              1.1.1.1PO-230821_pdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                                                                                                                                                                              • www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
                                                                                                                                                                                              AFfv8HpACF.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                              • 1.1.1.1/
                                                                                                                                                                                              INVOICE_90990_PDF.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                              • www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
                                                                                                                                                                                              Go.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                              • 1.1.1.1/
                                                                                                                                                                                              147.182.211.77Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            209.222.21.115Setup (1).exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • pcapp.store/notify_app_v2.php?guid=4D802742-3099-9C0E-C19B-2A23EA1FC420&lastid=0&lasttime=0&end_v=fa.1079b&nocache=6015250

                                                                                                                                                                                                            Domains

                                                                                                                                                                                                            ⊘No context

                                                                                                                                                                                                            ASNs

                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                            ALABANZA-BALTUSyakuza.x86.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 208.56.246.184
                                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 64.176.203.93
                                                                                                                                                                                                            https://lifetraces.org/wp-cron.phpGet hashmaliciousPhisherBrowse
                                                                                                                                                                                                            • 65.108.145.65
                                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 64.176.203.93
                                                                                                                                                                                                            GkyZlYczv9.dllGet hashmaliciousBumbleBeeBrowse
                                                                                                                                                                                                            • 65.108.214.195
                                                                                                                                                                                                            IP0XYLm4Uv.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                            • 65.109.243.0
                                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 64.176.203.93
                                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 64.176.203.93
                                                                                                                                                                                                            0T32Kz4dZU.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                            • 65.108.249.83
                                                                                                                                                                                                            AS-CHOOPAUSyakuza.sparc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 144.203.17.212
                                                                                                                                                                                                            yakuza.arm5.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 149.248.34.244
                                                                                                                                                                                                            PO238109.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                            • 45.32.153.255
                                                                                                                                                                                                            INQ9970.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                            • 45.32.153.255
                                                                                                                                                                                                            https://astonishing-maize-sunstone.glitch.me/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                            • 45.76.112.20
                                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 209.222.21.115
                                                                                                                                                                                                            H1CYDJ8LQe.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                            • 78.141.202.204
                                                                                                                                                                                                            nuklear.arm.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                            • 78.141.232.147
                                                                                                                                                                                                            https://astonishing-maize-sunstone.glitch.me/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 45.76.112.20
                                                                                                                                                                                                            BV-PUBLIC-ASNUSSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 147.182.211.77
                                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 147.182.211.77
                                                                                                                                                                                                            https://averellharriman.sharefile.com/public/share/web-s3b96c17360cd43e7bdcaf25a23709fd0Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 147.182.200.48
                                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 147.182.211.77
                                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 147.182.211.77
                                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 147.182.211.77
                                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 147.182.211.77
                                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 147.182.211.77
                                                                                                                                                                                                            la.bot.sh4.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 147.182.236.130

                                                                                                                                                                                                            JA3 Fingerprints

                                                                                                                                                                                                            ⊘No context

                                                                                                                                                                                                            Dropped Files

                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\nsb5A9.tmpSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  https://pcapp.store/pixel.gifGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002d.db

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):106768
                                                                                                                                                                                                                        Entropy (8bit):4.022716223006556
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:768:CJes7Fk3r1kDGsHhXOjk0Yct63CXBwNXLF/aJIYXxkxvRCR1vcdPk8dRmRypE3o4:BLknHqtImBNubhBiQG9n1aFjKGBGx
                                                                                                                                                                                                                        MD5:DBBD460BD2CCBED1B3FA79B52150548D
                                                                                                                                                                                                                        SHA1:E57E21F77C2C33684D352F2071181A88E1815CB2
                                                                                                                                                                                                                        SHA-256:C5DA38EFE8046885F836E3E59E957B36D39D9EC4F2A67C8529063DE48FEE6F7E
                                                                                                                                                                                                                        SHA-512:A8B73371F36D2B0EA5B392638EDF2EDB7FB5BFF4EA6A8644395011FFFB82D37B3F6E62AB7DA7D8343E284EFF5E3F5600D5588F0751CE82A9D0887971E641079E
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:....h... ...............P...............Z...(..._...h...................X.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................. ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[1].gif

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                        File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):42
                                                                                                                                                                                                                        Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                        MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                        SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                        SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                        SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsb5A9.tmp

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):93386616
                                                                                                                                                                                                                        Entropy (8bit):7.99999306217129
                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                        SSDEEP:1572864:52KX1mfH5AoIZnp9/pkhKzHjrSADzxet6X3mRsDqpszbyxjpB3ayh1sN1KGoMy1u:5jExAJh/pksTnFet6mu2G0jptggJ+flP
                                                                                                                                                                                                                        MD5:84EE733F8014D22DAD2DFEF725489980
                                                                                                                                                                                                                        SHA1:950A437488464103B9BF34610962C22192585BFC
                                                                                                                                                                                                                        SHA-256:F42D2BF4A50AB0CDB4A1C43964F0429C4663E27C76D8C61AFA174A531A7819A1
                                                                                                                                                                                                                        SHA-512:132C9BE1217804B73F8A99EA44D702E9DA0782CB6BBCC80DB2C2C72BDA1A93D06B2ADEF1B464F9163311F7482B2400553BA082C0F7F3CCF3B42C8C9B881306EB
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 46%
                                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                                        • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                        • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                        • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                        • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                        • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                        • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ............@.............................................HO.......... ..X)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse5976.tmp\Math.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):69120
                                                                                                                                                                                                                        Entropy (8bit):6.024967061017882
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:1536:GUZ9QC7V7IGMp2ZmtSX5p9IeJXlSM2tS:T97WSth5lwt
                                                                                                                                                                                                                        MD5:85428CF1F140E5023F4C9D179B704702
                                                                                                                                                                                                                        SHA1:1B51213DDBAEDFFFB7E7F098F172F1D4E5C9EFBA
                                                                                                                                                                                                                        SHA-256:8D9A23DD2004B68C0D2E64E6C6AD330D0C648BFFE2B9F619A1E9760EF978207A
                                                                                                                                                                                                                        SHA-512:DFE7F9F3030485CAF30EC631424120030C3985DF778993342A371BF1724FA84AA885B4E466C6F6B356D99CC24E564B9C702C7BCDD33052172E0794C2FDECCE59
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w.................F.........................5.....5....:6....Rich...........PE..L.....Oa...........!................KG....................................................@.............................B.......(....................................................................................................................text...b........................... ..`.rdata..R...........................@..@.data............2..................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse5976.tmp\NSISFastLib.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):140288
                                                                                                                                                                                                                        Entropy (8bit):6.334087823000165
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3072:H5dnvmOEATceozVDkRasOCdUFZrR7beB2SK0XCC+W/ST+BeXZQUC5:ZdnvmsTceZUtCdUFZr9b4KznC5
                                                                                                                                                                                                                        MD5:9C7A4D75F08D40AD6F5250DF6739C1B8
                                                                                                                                                                                                                        SHA1:793749511C61B00A793D0AEA487E366256DD1B95
                                                                                                                                                                                                                        SHA-256:6EB17C527C9E7F7FEA1FDB2EA152E957B50A56796E53CE1E5946B165B82DEAEF
                                                                                                                                                                                                                        SHA-512:E85235307B85FFD3AAB76FF6290BEE0B3B9FD74C61A812B5355FE7B854D4C6B77BD521E52638D28E249A43D9EC7AA6F2670AF2B1C671091492C7FE19D6F9A4E6
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......../.iTN.:TN.:TN.:.6.;^N.:.6.;.N.:.6.;@N.:.6.;UN.:...;AN.:...;DN.:...;{N.:.6.;_N.:TN.:'N.:B..;QN.:B..;UN.:B.%:UN.:TNM:UN.:B..;UN.:RichTN.:........................PE..L...z..f...........!...(.x...................................................`..............................................x...x....0..X....................@......0...............................p...@............................................text...0v.......x.................. ..`.rdata..\~...........|..............@..@.data...............................@....rsrc...X....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse5976.tmp\System.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                        Entropy (8bit):5.814115788739565
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
                                                                                                                                                                                                                        MD5:CFF85C549D536F651D4FB8387F1976F2
                                                                                                                                                                                                                        SHA1:D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
                                                                                                                                                                                                                        SHA-256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
                                                                                                                                                                                                                        SHA-512:531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse5976.tmp\image.gif

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):997
                                                                                                                                                                                                                        Entropy (8bit):4.188896534234179
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12:2E5KZbHOjOruFw6MLxENScRVar7FC53tK1Oqd3Aa0n:tAlHOjOX60ENvRVZKbEn
                                                                                                                                                                                                                        MD5:1636218C14C357455B5C872982E2A047
                                                                                                                                                                                                                        SHA1:21FBD1308AF7AD25352667583A8DC340B0847DBC
                                                                                                                                                                                                                        SHA-256:9B8B6285BF65F086E08701EEE04E57F2586E973A49C5A38660C9C6502A807045
                                                                                                                                                                                                                        SHA-512:837FA6BCBE69A3728F5CB4C25C35C1D13E84B11232FC5279A91F21341892AD0E36003D86962C8AB1A056D3BEEB2652C754D51D6EC7EEE0E0EBFE19CD93FB5CB0
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:GIF89a............P..........4q...5j...O..F.].......................o..._.....5y.t........\....K>}...g..t....X...B..ET....t~....go..Jx...........|..U!f.|....>u.M.........w>..+r...|...A{.....t...E...b.8}....d....A.....R..y..l...w....G5u...{....t.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H..A....`pp....~.xR......d.......,...D...)2 .1.....N` R......(@......,8RDA../..XB....P.F .....#...b`F...#8p......<\.`.........A....n|.CH...........+... .E.....d`.@......;

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse5976.tmp\inetc.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):39424
                                                                                                                                                                                                                        Entropy (8bit):4.684597989866362
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
                                                                                                                                                                                                                        MD5:A35CDC9CF1D17216C0AB8C5282488EAD
                                                                                                                                                                                                                        SHA1:ED8E8091A924343AD8791D85E2733C14839F0D36
                                                                                                                                                                                                                        SHA-256:A793929232AFB78B1C5B2F45D82094098BCF01523159FAD1032147D8D5F9C4DF
                                                                                                                                                                                                                        SHA-512:0F15B00D0BF2AABD194302E599D69962147B4B3EF99E5A5F8D5797A7A56FD75DD9DB0A667CFBA9C758E6F0DAB9CED126A9B43948935FE37FC31D96278A842BDF
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&.[.H.[.H.[.H.O.I.R.H.[.I...H...M.Y.H...L.Z.H...H.Z.H.....Z.H...J.Z.H.Rich[.H.................PE..L...n..c...........!.....T.........._........p............................... ............@..........................x......D...d...............................t....w..8...............................................D............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....i...........d..............@....idata..A............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse5976.tmp\nsJSON.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):24064
                                                                                                                                                                                                                        Entropy (8bit):5.819708895488079
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
                                                                                                                                                                                                                        MD5:F4D89D9A2A3E2F164AEA3E93864905C9
                                                                                                                                                                                                                        SHA1:4D4E05EE5E4E77A0631A3DD064C171BA2E227D4A
                                                                                                                                                                                                                        SHA-256:64B3EFDF3DE54E338D4DB96B549A7BDB7237BB88A82A0A63AEF570327A78A6FB
                                                                                                                                                                                                                        SHA-512:DBDA3FE7CA22C23D2D0F2A5D9D415A96112E2965081582C7A42C139A55C5D861A27F0BD919504DE4F82C59CF7D1B97F95ED5A55E87D574635AFDB7EB2D8CADF2
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.'..fI_.fI_.fI_3.H^.fI_.fH_?fI_.8M^.fI_.8I^.fI_.8._.fI_.8K^.fI_Rich.fI_........PE..L...`..Z...........!.....>..........E........P............................................@..........................X......@Z..P....p..........................H....X...............................................P...............................text...W<.......>.................. ..`.rdata.......P.......B..............@..@.data...@....`.......R..............@....rsrc........p.......T..............@..@.reloc..H............X..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsj5946.tmp

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):318525781
                                                                                                                                                                                                                        Entropy (8bit):6.931313706371873
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3145728:EEnqgvUBRlhK9QJiDS610scieJq1SXCSnsmdAGonTn:EEIKe0Djq7hCSkH
                                                                                                                                                                                                                        MD5:1E82AC21A0AB4FB084013AC7F54B3647
                                                                                                                                                                                                                        SHA1:152308A3F71C6CB7EADC4A6ECE3991E679CFC92F
                                                                                                                                                                                                                        SHA-256:6A776340A1B9EC3E8094D3B46C247A3144F882D57AD976E6467407B8E09C3204
                                                                                                                                                                                                                        SHA-512:A2F2C3C83F2FA83EEDBC3D70BF60E7DD16794B7DACD41FF2DA225034349ED2FDA070BA12F4E5E880A5B5FD81FA58B9C115B9A5812728575750704647654FDE89
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.7......,.......,.......D...=...........^6......\7..............................................................m...........................................................................................................................................................................3................2..................................................................................................................................j.......................k...................................................................................................................s..........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\NSISFastLib.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):140288
                                                                                                                                                                                                                        Entropy (8bit):6.334087823000165
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3072:H5dnvmOEATceozVDkRasOCdUFZrR7beB2SK0XCC+W/ST+BeXZQUC5:ZdnvmsTceZUtCdUFZr9b4KznC5
                                                                                                                                                                                                                        MD5:9C7A4D75F08D40AD6F5250DF6739C1B8
                                                                                                                                                                                                                        SHA1:793749511C61B00A793D0AEA487E366256DD1B95
                                                                                                                                                                                                                        SHA-256:6EB17C527C9E7F7FEA1FDB2EA152E957B50A56796E53CE1E5946B165B82DEAEF
                                                                                                                                                                                                                        SHA-512:E85235307B85FFD3AAB76FF6290BEE0B3B9FD74C61A812B5355FE7B854D4C6B77BD521E52638D28E249A43D9EC7AA6F2670AF2B1C671091492C7FE19D6F9A4E6
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......../.iTN.:TN.:TN.:.6.;^N.:.6.;.N.:.6.;@N.:.6.;UN.:...;AN.:...;DN.:...;{N.:.6.;_N.:TN.:'N.:B..;QN.:B..;UN.:B.%:UN.:TNM:UN.:B..;UN.:RichTN.:........................PE..L...z..f...........!...(.x...................................................`..............................................x...x....0..X....................@......0...............................p...@............................................text...0v.......x.................. ..`.rdata..\~...........|..............@..@.data...............................@....rsrc...X....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\System.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                        Entropy (8bit):5.814115788739565
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
                                                                                                                                                                                                                        MD5:CFF85C549D536F651D4FB8387F1976F2
                                                                                                                                                                                                                        SHA1:D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
                                                                                                                                                                                                                        SHA-256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
                                                                                                                                                                                                                        SHA-512:531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\image.gif

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                        File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):997
                                                                                                                                                                                                                        Entropy (8bit):4.188896534234179
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12:2E5KZbHOjOruFw6MLxENScRVar7FC53tK1Oqd3Aa0n:tAlHOjOX60ENvRVZKbEn
                                                                                                                                                                                                                        MD5:1636218C14C357455B5C872982E2A047
                                                                                                                                                                                                                        SHA1:21FBD1308AF7AD25352667583A8DC340B0847DBC
                                                                                                                                                                                                                        SHA-256:9B8B6285BF65F086E08701EEE04E57F2586E973A49C5A38660C9C6502A807045
                                                                                                                                                                                                                        SHA-512:837FA6BCBE69A3728F5CB4C25C35C1D13E84B11232FC5279A91F21341892AD0E36003D86962C8AB1A056D3BEEB2652C754D51D6EC7EEE0E0EBFE19CD93FB5CB0
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:GIF89a............P..........4q...5j...O..F.].......................o..._.....5y.t........\....K>}...g..t....X...B..ET....t~....go..Jx...........|..U!f.|....>u.M.........w>..+r...|...A{.....t...E...b.8}....d....A.....R..y..l...w....G5u...{....t.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H..A....`pp....~.xR......d.......,...D...)2 .1.....N` R......(@......,8RDA../..XB....P.F .....#...b`F...#8p......<\.`.........A....n|.CH...........+... .E.....d`.@......;

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\inetc.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):39424
                                                                                                                                                                                                                        Entropy (8bit):4.684597989866362
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
                                                                                                                                                                                                                        MD5:A35CDC9CF1D17216C0AB8C5282488EAD
                                                                                                                                                                                                                        SHA1:ED8E8091A924343AD8791D85E2733C14839F0D36
                                                                                                                                                                                                                        SHA-256:A793929232AFB78B1C5B2F45D82094098BCF01523159FAD1032147D8D5F9C4DF
                                                                                                                                                                                                                        SHA-512:0F15B00D0BF2AABD194302E599D69962147B4B3EF99E5A5F8D5797A7A56FD75DD9DB0A667CFBA9C758E6F0DAB9CED126A9B43948935FE37FC31D96278A842BDF
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&.[.H.[.H.[.H.O.I.R.H.[.I...H...M.Y.H...L.Z.H...H.Z.H.....Z.H...J.Z.H.Rich[.H.................PE..L...n..c...........!.....T.........._........p............................... ............@..........................x......D...d...............................t....w..8...............................................D............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....i...........d..............@....idata..A............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\modern-wizard.bmp

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                        File Type:PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):26494
                                                                                                                                                                                                                        Entropy (8bit):1.9568109962493656
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
                                                                                                                                                                                                                        MD5:CBE40FD2B1EC96DAEDC65DA172D90022
                                                                                                                                                                                                                        SHA1:366C216220AA4329DFF6C485FD0E9B0F4F0A7944
                                                                                                                                                                                                                        SHA-256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
                                                                                                                                                                                                                        SHA-512:62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\nsDialogs.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):9728
                                                                                                                                                                                                                        Entropy (8bit):5.158136237602734
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
                                                                                                                                                                                                                        MD5:6C3F8C94D0727894D706940A8A980543
                                                                                                                                                                                                                        SHA1:0D1BCAD901BE377F38D579AAFC0C41C0EF8DCEFD
                                                                                                                                                                                                                        SHA-256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
                                                                                                                                                                                                                        SHA-512:2094F0E4BB7C806A5FF27F83A1D572A5512D979EEFDA3345BAFF27D2C89E828F68466D08C3CA250DA11B01FC0407A21743037C25E94FBE688566DD7DEAEBD355
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L.....Oa...........!.........0......g........0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..~............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\nsJSON.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):24064
                                                                                                                                                                                                                        Entropy (8bit):5.819708895488079
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
                                                                                                                                                                                                                        MD5:F4D89D9A2A3E2F164AEA3E93864905C9
                                                                                                                                                                                                                        SHA1:4D4E05EE5E4E77A0631A3DD064C171BA2E227D4A
                                                                                                                                                                                                                        SHA-256:64B3EFDF3DE54E338D4DB96B549A7BDB7237BB88A82A0A63AEF570327A78A6FB
                                                                                                                                                                                                                        SHA-512:DBDA3FE7CA22C23D2D0F2A5D9D415A96112E2965081582C7A42C139A55C5D861A27F0BD919504DE4F82C59CF7D1B97F95ED5A55E87D574635AFDB7EB2D8CADF2
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.'..fI_.fI_.fI_3.H^.fI_.fH_?fI_.8M^.fI_.8I^.fI_.8._.fI_.8K^.fI_Rich.fI_........PE..L...`..Z...........!.....>..........E........P............................................@..........................X......@Z..P....p..........................H....X...............................................P...............................text...W<.......>.................. ..`.rdata.......P.......B..............@..@.data...@....`.......R..............@....rsrc........p.......T..............@..@.reloc..H............X..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\temp

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):42
                                                                                                                                                                                                                        Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                        MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                        SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                        SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                        SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Fri Oct 25 14:14:38 2024, mtime=Wed Nov 6 16:38:42 2024, atime=Fri Oct 25 14:14:38 2024, length=3116888, window=hide
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1857
                                                                                                                                                                                                                        Entropy (8bit):3.4764574295982227
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24:8g7vIKPdXx6kRIyAtDN6RknwtkkyHiO/7EXqyFm:8gBP6kRIRtBkknOyHiwyF
                                                                                                                                                                                                                        MD5:C6DB29D5F0650E92B7F5ADFE0232AEBD
                                                                                                                                                                                                                        SHA1:E79EE6D3644664E3A4BE140FA18C279A9718C083
                                                                                                                                                                                                                        SHA-256:512AC2250B0E1468C66D3CF44D6EEC9F983DBC5857915F61BCF885B717CF59BA
                                                                                                                                                                                                                        SHA-512:F70E3696E2F2A52D9E53A7CEEF3455485F0C13F47258D2A204844A27C4FBD826D01EEA65BD7025E957E599B759DAA966857D131C7D8FA356D0214B22CC9DF624
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:L..................F.@.. .....y..&...#.r0....y..&..X./.....................0.:..DG..Yr?.D..U..k0.&...&......vk.v.....x".r0....:.r0......t...CFSF..1.....fY...PCAPPS~1....t.Y^...H.g.3..(.....gVA.G..k...F......fY.fY............................").P.C.A.p.p.S.t.o.r.e...D.j.2.X./.YY.y .PCAPPS~1.EXE..N......YY.yfY...............................P.c.A.p.p.S.t.o.r.e...e.x.e.......W...............-.......V...........fF.A.....C:\Users\user\PCAppStore\PcAppStore.exe..+.....\.....\.....\.....\.....\.....\.P.C.A.p.p.S.t.o.r.e.\.P.c.A.p.p.S.t.o.r.e...e.x.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.P.C.A.p.p.S.t.o.r.e.../.i.n.i.t. .d.e.f.a.u.l.t. .s.h.o.w.M.(.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.P.C.A.p.p.S.t.o.r.e.\.p.c.a.p.p.s.t.o.r.e...i.c.o.........%USERPROFILE%\PCAppStore\pcappstore.ico.............................................................................................................................................................................................................................%

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\AutoUpdater.exe

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):586584
                                                                                                                                                                                                                        Entropy (8bit):6.337989770444409
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:BYnWgtbxN7L7kYcMB/cA4hxWbZKcXErHNkQLtZ9wNmCc0r93SFzd7FSAaxXDj5w:BYnWC7sQB/cA4nLrtkWemCn9YBUxXXy
                                                                                                                                                                                                                        MD5:693221C78FDC00A0F87FB3D1381308D4
                                                                                                                                                                                                                        SHA1:5ABD1481B0918A1815B542BFCB2EAD542C233DB8
                                                                                                                                                                                                                        SHA-256:6BB4786AB76767D1F9B2E19FD1A20F2F76CF1BB96127FC26741F2BE609E7680D
                                                                                                                                                                                                                        SHA-512:A58F0A1EA54ED94EDF3129088D89F2064F7D93ECD30F9590307963B287C8FF45580DC4D9A48F6D6C4AF72DB6E1E82EEF0EA3E4BF756B93B159C3CDE808041CFD
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................f....f....f...............g.....gH.... ....g....Rich...........PE..d......g.........."....).....V.................@.....................................x....`.................................................P............G...P..PR......X)..........P...T.......................(.......@............................................text............................... ..`.rdata...m.......n..................@..@.data....<....... ..................@....pdata..PR...P...T... ..............@..@.rsrc....G.......H...t..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\PcAppStore.exe

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):3116888
                                                                                                                                                                                                                        Entropy (8bit):5.959240683924359
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24576:V9kabuTUmENsEyg1IgoPYbvE8C9BHv3QJTbiNG8g9MEiYQgsSryyH2mtJXKMCSd+:V5bGEXi8mPY9pMFxu7cnZN3
                                                                                                                                                                                                                        MD5:4B88D8ADA8D22622C30D581FC38EAA52
                                                                                                                                                                                                                        SHA1:0980A7B75DB94035A5DE1696210648ACB95ACEDE
                                                                                                                                                                                                                        SHA-256:D4DE255AE1109391E4A4A967A8AD66DFB70FCCA7DB47777E40815F4E7B19F2A2
                                                                                                                                                                                                                        SHA-512:0F87422498ED3C60ED21CDA492D038D10509E3B40E5E9D7614B6CB0EF903E241AD1BA9C2F67B43D9DA3980990735A5E0C325002E43E0A41CB12947E2DBECF19F
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 8%
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l4 O.ZsO.ZsO.Zs.uYrG.Zs.u_r..Zs_.^r\.ZsFu.sM.Zs_.YrC.Zs_._r$.Zs.u^rX.Zs.u\rN.Zs.u[rf.ZsO.[s..Zs..^rM.Zs.._r~.Zs...sN.ZsO..sN.Zs..XrN.ZsRichO.Zs........PE..d......g.........."....)..&..........+"........@.............................P0....../...`...................................................*......./.P^....-......f/.X)... 0..&..0").p....................$).(.... ).@.............&.H............................text.....&.......&................. ..`.rdata...`....&..b....&.............@..@.data...H.... +.......+.............@....pdata........-.......,.............@..@.rsrc...P^..../..`..................@..@.reloc...&... 0..(...>/.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ReadMe.txt

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):146
                                                                                                                                                                                                                        Entropy (8bit):4.577360416859904
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3:TKPyFfliFRNAl2sIaRjyM1KOTxLELMZ4MKLJF8EelYq8AsXJVVWM4v:TyyFflmSssI+j1NLELM6MKn8EquZVVCv
                                                                                                                                                                                                                        MD5:2845450EA9D938CFEA9809CA0C827F12
                                                                                                                                                                                                                        SHA1:8DE2189530DA5923365436C37E4C55C500AC3FBF
                                                                                                                                                                                                                        SHA-256:7FDADB3CA5B81C6D1C58A20610921BF89D63DC65B77BE982F422C6FD2A13F166
                                                                                                                                                                                                                        SHA-512:7D19FE6E9DD51BB880FD6FBB7EE126C8078771EE5166D53F312B04D117CE2897CBB6DFB5E5627314C3CF8B56F7A2BBF5B9D38258E7912B0AC5D420B611B7C363
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:Fhis folder contains the PC App Store for Microsoft Windows.....For additional information, please visit https://pcapp.store/?p=lpd_appstore-faq..

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\Temp\tempPOSTData

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2261
                                                                                                                                                                                                                        Entropy (8bit):5.156729554312737
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:YZ1HdtyDF9hEs93ZMqr8ZPfOqfYLkGYOOzfhrE+ynSaQ876rYmfskM9vABvke8u:oNdAys9pMtZPPALkOOzVpynLQ87MYmfF
                                                                                                                                                                                                                        MD5:93A05ABEAF97A3DDFAA0D4C2BCEEB0B3
                                                                                                                                                                                                                        SHA1:7A014B039A410223978B12E26143710046865904
                                                                                                                                                                                                                        SHA-256:3E96EAD00BDBD5089A0A3C102588E769BC839709F18E4378586CA1D1DC7EC8F0
                                                                                                                                                                                                                        SHA-512:AB4B3C239262D49E0FB42277278B741D739A4D58F6462DD5B8448D69F21597EFAB746C5943EDDD839DF3C33EED3E5C36B356C4DAFED9514C782D44785B8C3BE8
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:{"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"_OSVGF","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"OXWABUVD+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Ado

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\Temp\tempPOSTResponse

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):73
                                                                                                                                                                                                                        Entropy (8bit):4.089026662492467
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3:YGVE8fptxgDQLRv6zjQJNRvUXZ5:YGFRt9IoNaZ5
                                                                                                                                                                                                                        MD5:3024A54E0C352ABE5EB5F753CA4828DA
                                                                                                                                                                                                                        SHA1:DF0206851654405C8E5C2D3BC96FB536B8C2DCBF
                                                                                                                                                                                                                        SHA-256:3CD0A703506C7394D6115D9FF721516560894358AEF07459F30D8930DF6C3B61
                                                                                                                                                                                                                        SHA-512:D9D44051DF56B29AA596EE38463B781DBE27F917F7DAE1B2420122616DA108520429DDA58C75C7E6B2D41093F83C5A4BAE96024885AF3956F23A3CE5BD3F9358
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:{"cpg":"default","inst_excl":null,"inst_addon":null,"inst_advanced":null}

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\Uninstaller.exe

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):93880
                                                                                                                                                                                                                        Entropy (8bit):6.891280387415397
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:1536:2msAYBdTU9fEAIS2PEtu3rLFn22G9RowU49TV1Z43kUFInU73ALu:FfY/TU9fE9PEtubZrMtkkxUUi
                                                                                                                                                                                                                        MD5:CD8B6F1BD281C288FB3F68925639B424
                                                                                                                                                                                                                        SHA1:25EA108C45905418B8FDA2FCCF5ADA0EDE2710E5
                                                                                                                                                                                                                        SHA-256:808FE10CBF09F21359E1D61860BFCDDE553F5CDA38723ECD0636FA25F652121D
                                                                                                                                                                                                                        SHA-512:A05C60EA499BEA246FF0CB3308108862CDC56BC44A4E14F546FE8AF4C52172F73F5973EBA03FF1F2BB1C575C15BF62421034C02AFA703D093B986F95A999E1B6
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 29%
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ......f.....@.............................................HO..........`E..X)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\Watchdog.exe

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):276312
                                                                                                                                                                                                                        Entropy (8bit):6.155274238783893
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3072:JNh5y0IKTcOq1wpRsrIA/uuNT4KddgLA/exq10mMfnW9L/or6RMr4T+cnOMX4Hen:jyJKA5KKdWLA/GZhnWlV94+3H3
                                                                                                                                                                                                                        MD5:11F3801CB9FF046D6075F681971C4EB8
                                                                                                                                                                                                                        SHA1:91572872A265185E7F9793B50C5257B511707B36
                                                                                                                                                                                                                        SHA-256:5BD22345C42FC1B7C89C281C9247BC81DBBDB4C8EF4DA76E2A9D86589D8CC118
                                                                                                                                                                                                                        SHA-512:B7E1A5F391E112AAC0CFA8239AD5AE784161C8734C9A4F3EF386FF617915F7AC769A5DB790B66BD95E6DAB8BAABCC4E51DE31D614193CB69909DF393DC77A021
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P........................H............Q.......Q.......Q..................t....P.......P&.......N......P......Rich............................PE..d......g.........."....).............,.........@.............................p...........`.....................................................x........G.......1......X)...`.......O..p....................Q..(...PN..@............................................text............................... ..`.rdata..............................@..@.data....%...........|..............@....pdata...1.......2..................@..@.rsrc....G.......H..................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\NW_store.exe

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2312704
                                                                                                                                                                                                                        Entropy (8bit):6.449649685576397
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:49152:gg6wrmvfu6ZPfRFq8BcvDEzT3CuaMUgKS:H8Zn3Ci
                                                                                                                                                                                                                        MD5:E472E46BDFD736351D4B086B4C4CA134
                                                                                                                                                                                                                        SHA1:1AA886F0CB23B3D322A43BE797D411FCA84D82A7
                                                                                                                                                                                                                        SHA-256:E825A252B5C5C9C2DE8A6A6ADE12A7F9CD0040F6A20E6EE44BA659034E6D5223
                                                                                                                                                                                                                        SHA-512:173F5A7ABDFEA01C9C21EC716CBA14EEC4539DA45E5734B3FD1E0688E1C22E4718BD701C25C8040D20CF48867E2A67EF2ABA46380BAB9AB1F7A42BD66FD33AFB
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."..........R.......R.........@.............................0$...........`.........................................',.......,..d....0........................$.@!..l...8...................@...(.......8............4..........`....................text...X........................... ..`.rdata..............................@..@.data............F..................@....pdata..............................@..@.gxfg...P........0..................@..@.retplne.............N...................tls.................P..............@....voltbl.D............T..................CPADinfo8............V..............@..._RDATA...............X..............@..@malloc_h0.... .......Z.............. ..`.rsrc........0.......\..............@..@.reloc..@!....$.."...(#.............@..B................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\credits.html

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):9560433
                                                                                                                                                                                                                        Entropy (8bit):4.8475056659478915
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24576:/28lTEaiPJK0PJgVEv+F26vbV2f2EvYvAKMc/+uBPJ1PJLPJ1PJOPJDKspVosXxY:/2ETWgqSq+sIp2+qO1McdLRPiY2zXO
                                                                                                                                                                                                                        MD5:7A32B7C762C76BD3EE38E3E998705899
                                                                                                                                                                                                                        SHA1:E1C611A57115374A48CD84619BD06E43021B7352
                                                                                                                                                                                                                        SHA-256:726276A62DB14DD751F32B77200E90A8000712BD256ED038BEA928C6AEF0C892
                                                                                                                                                                                                                        SHA-512:9FE66FE4479915B0EFE12ADFB386BA251B2C2AF8CCD92B4D67F61C9D2AE537C6D3512E4379AFF10EAB3CD433FC1EDEC702E63DDFE4F83769A746FF249288D4DA
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview: Generated by licenses.py; do not edit. --><!doctype html>..<html>..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width">..<meta name="color-scheme" content="light dark">..<title>Credits</title>..<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">..<link rel="stylesheet" href="chrome://credits/credits.css">..</head>..<body>..<span class="page-title">Credits</span>..<a id="print-link" href="#" hidden>Print</a>..<label class="show show-all" tabindex="0">..<input type="checkbox" hidden>..</label>..<div class="open-sourced">.. Chromium software is made available as source code.. <a href="https://source.chromium.org/chromium">here</a>...</div>....<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->..<div class="product">..<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>..<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">h

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):4916712
                                                                                                                                                                                                                        Entropy (8bit):6.398049523846958
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                                                        MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                                                        SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                                                        SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                                                        SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\ffmpeg.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2028032
                                                                                                                                                                                                                        Entropy (8bit):6.64708834859118
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24576:x+QrVq8lxXjKAri3/8XLpvdZ4RAfdDY0K1w/cjWsdSJNTtMfxTCC:pdlNBfXt16RsFY0K3jWsdQVtM0C
                                                                                                                                                                                                                        MD5:5FFF6F0423A38BFAF174CB670650F4F9
                                                                                                                                                                                                                        SHA1:13ECD1C4784A5A178A998E9FC0DC08F556121712
                                                                                                                                                                                                                        SHA-256:D4E6FC4E1BC6CB5B3EF7010E61D3A65E97804FB20346CEE657688339075B2727
                                                                                                                                                                                                                        SHA-512:E6FF0EA9F6196470F6E094D0AB655FB527C28FC2B2A5D126A10C1F4185C0DFF5ED4F19E7ED717D67DF324562B7AA56ED87AA0BD396A6BA722D3141B9F30FC41B
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........D......0.........................................c...........`A.........................................T.......Z..(.....c.0.....b..|............c..2...<..8....................;..(....<..8...........8^..`............................text............................... ..`.rdata..\7.......8..................@..@.data....D......"..................@....pdata...|....b..~..................@..@.gxfg....,....c.....................@..@.retplne.....@c..........................tls.........Pc.....................@....voltbl.8....`c........................._RDATA.......pc.....................@..@.rsrc...0.....c.....................@..@.reloc...2....c..4..................@..B................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\icudtl.dat

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):10717392
                                                                                                                                                                                                                        Entropy (8bit):6.282534560973548
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
                                                                                                                                                                                                                        MD5:E0F1AD85C0933ECCE2E003A2C59AE726
                                                                                                                                                                                                                        SHA1:A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
                                                                                                                                                                                                                        SHA-256:F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
                                                                                                                                                                                                                        SHA-512:714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW*..K..P.*..L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\libEGL.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):454144
                                                                                                                                                                                                                        Entropy (8bit):6.3485070297294985
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:yLSe7mxAked1dLX9ValhL1IA9SbD/9PAE:yExAkedHLX9VC9OKE
                                                                                                                                                                                                                        MD5:7255FCCD39F330CA2123F380B4967E0A
                                                                                                                                                                                                                        SHA1:C8E0E1A3E129DF7AB8922F039FFDBBA20DFBA8E2
                                                                                                                                                                                                                        SHA-256:22C2E5452FB01513C331B9E88313830C96EB3E554FAB942AFCBD6FB8702DF730
                                                                                                                                                                                                                        SHA-512:ECD66B0A43AEFD2C4721CD574D2394A2A9069B5258E310A0FC16C3919FD2505BFE91DB2FF8E4B5C7EF0187C86B167004659D15943F5BE6DF42BBFC297FB42119
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................7....................................................`A........................................`...h.......(.......x........A..............(...L...8...................0...(....)..8............... ............................text...2........................... ..`.rdata...}.......~..................@..@.data....O...`... ...H..............@....pdata...A.......B...h..............@..@.gxfg...`%.......&..................@..@.retplne.....0...........................tls....!....@......................@....voltbl.8....P.........................._RDATA.......`......................@..@malloc_h0....p...................... ..`.rsrc...x...........................@..@.reloc..(...........................@..B........................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\libGLESv2.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):8058880
                                                                                                                                                                                                                        Entropy (8bit):6.448026576223661
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:98304:XUoMnbHa6h5CmPt75W2+G15kI6a7Xm3rC:gDTCe4rt/aTCr
                                                                                                                                                                                                                        MD5:6CD8726BEEFCFA69B48EAB1362A5CAD5
                                                                                                                                                                                                                        SHA1:F4249179B86C0A870C55E6C5A263180C77017E81
                                                                                                                                                                                                                        SHA-256:2636DA528EDCAEC9834255A92411BD5DA921D793825D74CEB997E336A0DBD393
                                                                                                                                                                                                                        SHA-512:0F6600315B0E1B5371BB39290E5417EBAA0F3C7FB47EEF32D73AFCE299722A426DD244FD3775D88FCEB6F170F16B23B099244EE825F7F8185D58F1BF28583515
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......^...........Z.......................................{...........`A.........................................2r.......s.d.....z.......x.HX............{.|...$.q.8.....................q.(.....p.8.............s.....@1r.@....................text.....^.......^................. ..`.rdata..d....0^.......^.............@..@.data.........s.......s.............@....pdata..HX....x..Z...pw.............@..@.gxfg....,...pz.......y.............@..@.retplne......z.......y..................tls....Q.....z.......y.............@....voltbl.D.....z.......y................._RDATA........z.......y.............@..@malloc_h0.....z.......z............. ..`.rsrc.........z.......z.............@..@.reloc..|.....{.......z.............@..B........................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\af.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):502905
                                                                                                                                                                                                                        Entropy (8bit):5.409605383978337
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:Mqyim2uho5EnirXKhaG1B2+H2JynyaH4IFzZo0vgElgA2W0PSq+2ss30fzO75g6p:U2uhounkXyd1B2+H2JynyaH4IFzZo0ve
                                                                                                                                                                                                                        MD5:8032CB8A1B40AC85ACBEAFD6514BE668
                                                                                                                                                                                                                        SHA1:EE15C360BD913FFEC94E9E36224548CA83B2564C
                                                                                                                                                                                                                        SHA-256:1762EB36E254C02A50ED089ED737235FD7A64C0D234581612ACA56F6398CAC97
                                                                                                                                                                                                                        SHA-512:956241DA1EE60C648417C6BF3921554F1F19AB17163DBDA764AE0DC21E1729C9357BFB900B1F948D2C649F9D53DA7CEFF3128B8CFAB34FD03053A8C37C663F5D
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z.................................................................Y.................&.......................).................H.....]...........#.....X.....q.................9.....G.......................*.......................4................./.....L.................:.....L.................6.....E.................T.....j...........R.......................G.....d.....u.................,.....9.............................I.......................?.......................%.....m.......................6.....].....f.................(.....1.................`.....w.................:.....R.......................5...............................................P.............................~.......................~...................................p.................] ..... ..... .....!.....!.....!.....!....."....Y"....}"....."....."....9#....d#

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\af.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\am.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):813426
                                                                                                                                                                                                                        Entropy (8bit):4.915984741122479
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:dTZog2ule8/xHT9KG3Sj+KRRz0l85X9icV03OzP+Xx30jH8+j:/ogg8/xpKGCj+KRRz085X9icV03OzP+W
                                                                                                                                                                                                                        MD5:7B88BD642C86EC4D4FB9A5614D1DA63F
                                                                                                                                                                                                                        SHA1:92CF23267B78039E2413F7F7F90E6636614A0C5C
                                                                                                                                                                                                                        SHA-256:0C1DE970426BA291B10CD08FF0E6B078ADF4C1D07B24E0D89D9322FD2EC2E296
                                                                                                                                                                                                                        SHA-512:17E2381491A8844D1AD6910C3876C817ADE5CF2DAD8461771BAE9E967F7F64954917E20F8258CE6548AF1C21F8CF7E9477C7BCDCE6DD216140BF4D32410A31D9
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........?&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...|.|...}.....................................................................................0.....O.....$.......................u.....-.......................i................................... .................\.....o...........h.................f...........7.....g.....J...........\........... .............................\.............................r...........l.....+.................Z.......................z...........".....5.................B.....U.......................?...........o ..... ..... ....r!.....!....Q"....g".....".....#.....#.....#....l$.....$....6%....F%.....%.....&...."'....H'.....'....;(....u(.....(....!).....).....).....).....*.....*....C+....\+.....,.....,.....,....E-.....-....'.....`............/...../...../.....0.....0....A1.....1.....1.....2....`3.....3.....4.....4....y5.....5.... 6.....6.....7.....7.... 8.....8.....8.....9.....9.....9....p:.....:

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\am.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ar-XB.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):822020
                                                                                                                                                                                                                        Entropy (8bit):4.925237393732045
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:vFB3t9DiYK8a4HHFLrgOIPcd1CyWpQ5fuiDbmpQ:vn3t5SzU5fu+
                                                                                                                                                                                                                        MD5:621B390B8AF0C70D682715323A92B61F
                                                                                                                                                                                                                        SHA1:C34B2F2C91CD0786FEBBD26223D1CB096A87C1F4
                                                                                                                                                                                                                        SHA-256:729B677BE93020DDEF1297869CA7378D3A102927294C634A1087D63F48FB8A79
                                                                                                                                                                                                                        SHA-512:E55691ED5FBCEF7AA8330CABDA72E9D803E12784B661A42FFE3FF725FE663AEF62EED407FDC2269135437AB7AE047A6F0CCEAA90F2349073E554DD45C5F9D0BC
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........&g.e.....h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....|.....}.........................................................................3.....N.....j...........].....!.................t...........p...........S...........}...........R...........J.....q.............................x...........H.....a...................................n.......................4.................A...........%.....A...........q.......................g.............................&.....G...........D.................!.............................A.................^ ..... ....R!....j!.....".....".....".....#.....#....,$.....$.....$....2%.....%.....&....5&.....&.....'.....(....E(.....(....P).....).....)....W*.....*....%+....R+.....+.....,.....,.....,.....-......................D/...../...../...../.....0....:1.....1.....1....o2.....2...._3.....3....s4....J5.....5.....6.....6....Y7.....7.....7.....8....'9....}9.....9....!:.....:.....:.....;.....;....M<.....<

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ar-XB.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ar.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):897122
                                                                                                                                                                                                                        Entropy (8bit):4.928723053414015
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:CIPFaBsPG/d/RXZwRq4fvPU7XUUk/K58N0j+JzIQ4pF:CIvAAC5h+c
                                                                                                                                                                                                                        MD5:3C8E3C5B1D029E9A01943DDBA053C37F
                                                                                                                                                                                                                        SHA1:785EE0C46B11A19C80770F2B310057E59D90C2E1
                                                                                                                                                                                                                        SHA-256:98CD654847FF28C0EE580A7374276EE5BD2A38DDE8F45ADFBACBD7917E4C026D
                                                                                                                                                                                                                        SHA-512:DCA2FC0BE678BEBF047DBAA5A71C01AD57F9B463E3F80DBFABC0937BCFDCEEFC8AE84FD415C40D0B6B713FFF24CEBFB84373ECDDE3741F78265E082C5B9951D0
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........%Q.e.>...h.B...i.M...j.Y...k.h...l.s...n.{...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....D.....I.....b...................................o...........,...........#.....E.......................0.......................$...........?.........................................x...........\...........\...........n...........s.....C.......................(.....{...........J...................................4.....s.............................r.................1...........;.....{...........K...... ....u ..... .....!.....!.....!.....!.....".....#....r#.....#.....$.....$.....$.....$....w%.....%....C&....X&.....&.....'.....'.....(.....(.....)....C)....i).....)....d*.....*....C+.....+....:,....X,.....,....{-.....-......................./.... /...../....C0.....0.....0....91.....1.....1.....2.....3.....3.....4.....4.....5.....6....e6.....6....+7.....7.....7.....8....g8.....8.....8.....9.....9....k:.....:.....:.....;

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ar.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\bg.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):927865
                                                                                                                                                                                                                        Entropy (8bit):4.686646990438899
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24576:4Tax7YKC3cquMMLYzzQkECPUwVbtbHp373ZL+3aAKHkVDYyKzumpod2nm5g0XuGq:W8C3cquMMLYUKUwVbtbHp373Zq3arkV8
                                                                                                                                                                                                                        MD5:27C55B97D549BCF13145EC75F0A503CA
                                                                                                                                                                                                                        SHA1:4D7BEC85366FBB602EB6FC02297FB402BD40B6BF
                                                                                                                                                                                                                        SHA-256:F2EB47878B5D34589A2AFC2E74AB346003BF4D2C450230B9CFD084935BB54A4D
                                                                                                                                                                                                                        SHA-512:CA3ABB2403B8A67A53F2156E11C361B137F45378737E39D45D5F77148FF3CD031E37DB9EA144B76749667CBA20698C2049E86CA5927475B1E22112751B9BDF3F
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z................................................................. .............................K...........................................................V.........................................^...........p...................................&.....n.....X.............................L...................................I.....\.....5.......................E ..... ..... ....R!.....!....5"....]".....".....#.....#.....#.....$....?%.....%.....%....h&.....&....<'....['.....'....n(.....(.....(....g).....)....#*....I*.....*....|+.....+.....+.....,.....-....}...........Y/...../....'0....W0.....0...._1.....1.....1.....2....w3.....3.....4.....5.....5....06.....6....L7.....7.....8....A8.....9.....9.....:....8:....&;.....;....;<....p<....`=....;>.....>.....?.....?.....@....7A.....A....LB.....B....?C....wC.....D.....D.....D.....E.....F.....F....hG

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\bg.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\bn.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1193463
                                                                                                                                                                                                                        Entropy (8bit):4.299730648702171
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3072:o3d2APzZl1uPXdf826YBWviytaGHFGuzhr0Ylf14/QISydDbrK8VBbFKQg51lNDS:o3d3Fl18fPAtt1MFSydHrK8VBbG5llA
                                                                                                                                                                                                                        MD5:7351AE61AE5884088AE68CE5BE0043D8
                                                                                                                                                                                                                        SHA1:DBEEA5DA228F63A405548F0E6F82FBBB3D624058
                                                                                                                                                                                                                        SHA-256:D367339A1AC5CE27E58AA03D33E567C06C02F4AC87DB26ACA5D8A3D915AAA01A
                                                                                                                                                                                                                        SHA-512:85D5D0372C162DE8660B4A8A4EC493585C6C3D29F999F1734C319532DB572A13C91C87320BE139F9FFA957ADD52CDC36584226FAF5AFC39F8A82A2E9C146156B
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.'...w.4...y.:...z.I...|.O...}.a.....i.....n.....v.....~.......................................................................Y.................I...........z.....Q...........*.....O.....I...........F.....>.............................G.......................G.............................Q.................t...........Z.....I.............................K.............................]............ .....!....Q"....."....n#.....$....L$.....$....'%.....%.....%.....&.....&....H'....{'.....'....~(....-).....).....).....*....(+.....+.....+....s,.....-....g-.....-....5...........!/....D/...../.....0.....0.....1..../2....K3.....4....^4....X5....'6.....6.....6.....7.....8....L8....|8....J9.....:....w:.....:.....;....d<.....<....s=....->.....>.....?....??....$@.....@....-A....eA....hB.....C.....C.....C....)E....}F....pG.....G.....H.....I.....J.....J.....K.....L.....L....0M.....M.....N....7O....fO....lP....@Q

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\bn.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ca.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):573774
                                                                                                                                                                                                                        Entropy (8bit):5.391859865204477
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:gQQL7QREpAp973K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuCJkdz:hb9zaBRnvWDMN8UpOO5k/mVb
                                                                                                                                                                                                                        MD5:F6E50323E0C5A657EBDC2FE7285C15F6
                                                                                                                                                                                                                        SHA1:944356D207A7962A81801BB76B0E2C5226FF7F1E
                                                                                                                                                                                                                        SHA-256:DE474CF24B68B6D862C96B8057EDE3F53C6F63C46532E4988E9D1979B1CF59DA
                                                                                                                                                                                                                        SHA-512:8BC4EA1E2EB03E0423A7C3008BF6001B904928B5B7D7E84D61469C8D8CDBD34E9A4FFFA900B7CBF4216FBA3A469D7A26AF9C22E618902C28044F426693B09EC7
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........"&+.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.$...y.*...z.9...|.?...}.Q.....Y.....^.....f.....n.....v.....}.................................................................9.................3...................................n.................P.......................T.......................K.....~.................y.................n...........$.....J.................^.....r...........,.....c.....w...........U.................Q...........5.....[.................<.....X.......................(......................................... .....5.......................1.............................[.......................>.......................^.................0.......................3.......................V.......................t.................Z.................. ....7 ..... ..... .....!....(!.....!.....!....6"....R"....."....w#.....#.....$.....$.....$....0%....Z%.....%....)&....\&....|&.....&.....'....='....P'.....'....((....h(.....(

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ca.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\cs.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):583431
                                                                                                                                                                                                                        Entropy (8bit):5.838398613999325
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:eV2UufpvPlAhTbe65aU8rwsiNOA3SzmPN:eV2UufpvNAhHh5aU8rvYOrzmPN
                                                                                                                                                                                                                        MD5:7F1AD2897B210C4C25CFBDF0736F6809
                                                                                                                                                                                                                        SHA1:62E0335A63BC9E2AE8A9826E08256B00E433D9F5
                                                                                                                                                                                                                        SHA-256:E0826C8E2FE737307D09D808BC693A397E0F1E093AC249B24CEB48327685A4A4
                                                                                                                                                                                                                        SHA-512:C656B1FF7FCD93B3AEF5FC9E91373D0588520546EAF6CB5E2F965FD66ED0D60E2C04FB22155723D6EFDFDB377EF98CD6420F9944C5B0FC4AE8DE14C830A05B15
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........&;.e.j...h.n...i.v...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.1.....9.....>.....F.....N.....V.....].....d.....k.....l.....m.....o.............................T...........G.....e...........).....^.....m...........p.................V.......................{.................$.....w.......................z.................7...........H.................$.......................N.......................w...........2.....G...........B.......................Q.....n.................*.....V.....h................./.....@.................F.....Z.................R.....d.................9.....F.................H.....[...........*.....d.....x...........m.......................`.....{.................0.....Q.....p...........7.....c.....y...........Y.......................w.................. ..... ..... ..... ....I!.....!.....!....."....t"....."....0#....B#.....#....T$.....$.....$....2%.....%.....%.....%....<&.....&.....&.....&....@'.....'.....'

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\cs.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\da.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):530651
                                                                                                                                                                                                                        Entropy (8bit):5.44607278354406
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:QnPhyMLsqSAzVWgss5sbse814eBjtwlRDdJwL2obEXZaFRQ5gk2rp/b3d4nTGqF5:WDgxsJjiT55g/r2Tpj
                                                                                                                                                                                                                        MD5:9D6A98D53208092F687AD7BB3DBAED7D
                                                                                                                                                                                                                        SHA1:161D0689CA85147B356167F98EAD84783E331986
                                                                                                                                                                                                                        SHA-256:04BF402123BFA1C7E256A62A666C0488A42ACEB585C1A9A744341EBC6FDD9A7C
                                                                                                                                                                                                                        SHA-512:B85832A3DBF5C97870683A655E2CB0F00C04DA4907644561894BB34DE9756334E60CAF75F0CB42E43692BF00C5EF3CFBE6D2E8F7802FFED8E6948757D2DE3E5A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................\.................".................@.....X...........d.................1.......................1.............................x.......................y.................<.......................w...........#.....6.................C.....W...........`.................]...........5.....[.................8.....J.......................#.....q.......................\.......................b.......................[.......................?.......................!.......................-.......................t.......................X.......................3.......................0.......................n.......................n............ ..... ..... ..... .....!.....!.....!.....!....:"....H"....."....Y#.....#.....#....%$.....$.....$.....$.....%....d%.....%.....%.....%....O&.....&

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\da.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\de.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):571551
                                                                                                                                                                                                                        Entropy (8bit):5.489447532911186
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:if1WFbCgp1nHaxa03K7UpKD93g/ahmOC2GzV6wAXaOV5jbt5sRqJoUaM5QIBCAL:wQAgnp03K7Up4g/a01JE3t5yUfvBCAL
                                                                                                                                                                                                                        MD5:851D55585CBC90143DD4C70EB4900574
                                                                                                                                                                                                                        SHA1:DA5DBD04CFEFE63D1DB69D7C6E19DAC34F379C39
                                                                                                                                                                                                                        SHA-256:DDBAFE037C6E7509650373D084BC0F198D3ABB7BFD93FAEDD5595F1B354EDC32
                                                                                                                                                                                                                        SHA-512:B1718430F3540F2455E93A1F6C47E92D7FEA99A9943E8C585EBD4DD807B5A4C1172BBDC83D434EE806C5FC3875B60D7EBDEB933D1CDE6DB50DCED9C0DAAFCD04
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}.........................................................................................................................{...........;.....P...........H.................).......................e...................................:.....N...........T.................=.................!...........".....\.....m...........o.................V...........<.....V.............................z.................".................%.....7.................6.....G...........T.................!.......................S.......................|...........&.....5...........'....._.....q.............................w.......................q.................. ....o ..... ..... .....!.....!....)"....b"....."....."....c#.....#.....#.....$....}$.....$.....$....H%.....%.....%.....&.....&.....'....b'....l'.....(.....(.....(.....(....e).....).....*.....*.....*.....*.....+....)+.....+....(,....`,

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\de.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\el.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1016551
                                                                                                                                                                                                                        Entropy (8bit):4.766567786580532
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24576:WStxYcxPdGgxh1hxFFiL9+YJXDsSaSmqHuuD2Np6P4j/MAVH8yeVd85tRDQr3egJ:TtxYcxPdGgxh1hxFFiL9+YJXDsSaSmqv
                                                                                                                                                                                                                        MD5:F497F06BC0430F2FA1E2BFFC32E2B9C5
                                                                                                                                                                                                                        SHA1:38141C3F85FD4A8FCF2A82B0DEB68BD93F062F60
                                                                                                                                                                                                                        SHA-256:B3CB15115252BBF1363B7231ED32309C9E2E5B6EEEC1B2BBC2700A49A26E56D0
                                                                                                                                                                                                                        SHA-512:C455DE6466A9FA535C685163A6B4540DC00EB51CC5565ADDFB0E124E3A29CD4AFEC7AB9DF7848C9D3A6C7F435E1CC761F74D8F162D8BC7378D086E96EFA2E705
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z...........................................................R.....y.....W...........C.....>...................................X.................C.......................O.................k...........J.....j.....9...........X.......................(.....b.....4...........s...........u.....1.......................z...........0.....d.....\...... ....I ..... .....!.....!....!".....".....#.....#.....#.....$....<%....|%.....%.....&....m'.....'.....(.....(.....).....)...."*.....*.....+....1,....X,.....-.....-....'.....N....../...../....#0....D0....O1....W2.....2....%3.....3.....4....!5....V5.....5.....6.....6.....6.....7....(8.....8.....8.....9....Y:.....:....-;.....;....|<.....<.....<.....=....l>.....>.....>.....?.....@....!A....PA....zB.....C....KD.....D.....E....lF.....F....&G....6H....2I.....I.....I.....J....iK.....K.....K.....L.....M....zN

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\el.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\en-GB.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):459985
                                                                                                                                                                                                                        Entropy (8bit):5.5152848417450615
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:HAeAGZgSZ+XKFELrqmjLCd3MP9ej7HXfaYISMv5n5CSEBcWRnFc:HjfZgseoEL5C3Ma7H6N5CSgc
                                                                                                                                                                                                                        MD5:F8EEEBF6B363D8578D769AA05FED5BA7
                                                                                                                                                                                                                        SHA1:12E8B6FE48CA49936769B766A9A13510D9569A20
                                                                                                                                                                                                                        SHA-256:1F7D3BEACD2A55F3BF2D3571BEF1D05FA333FADD9E6CA141C2525B0678824CDD
                                                                                                                                                                                                                        SHA-512:3AAE1B6881E50E88635336218D7C13ACF81687AD78FB902900746EB875D9DD29DBF83A1D51344DF617DD86E31BAAD04564460ECC48886308E742830412E8C71D
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........&..e.`...h.d...i.r...j.~...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.-.....5.....:.....B.....J.....R.....Y.....`.....g.....h.....i.....n.....{.............................~.......................|.................$.....}.................(.....t.......................J.....s.......................5.....B.............................v.......................l.......................H.............................^.......................^.......................*.....E.....T.............................8.....u.......................J.....|.................&.....S....._.......................!.....i.......................).....n.......................[.......................:.....].....s.............................{.......................J.......................1.....h.......................;.....j.....z.................W.....o...........B.......................X.......................N.....z.......................4.....D..................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\en-GB.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\en-US.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):464664
                                                                                                                                                                                                                        Entropy (8bit):5.505055040425703
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:V0BSJCCPeiISZuw3jcMP9eD3D9faYLbcNx5FSZngP/eXywB:8SJDPeDIjcMY3DzA5FSHywB
                                                                                                                                                                                                                        MD5:4B6300C27E7575C32888C1F3364D5346
                                                                                                                                                                                                                        SHA1:C5F5E1D3524ACC96FB4E18C08B02F54ABF83C3D4
                                                                                                                                                                                                                        SHA-256:0945C89B16D4FEBA346E85E14792B772DCC6278F7DCA7FB099A6100C93E79740
                                                                                                                                                                                                                        SHA-512:3F21B6F4A3E18755B355CE5F20384D549B3F723104A67C67AE521D2C4544AA3095FADA8855A0CC1A10E7C5BF3E8F55D061AB2DCEC210F76101A61D9484D4EE6F
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.I...t.R...v.g...w.t...y.z...z.....|.....}.............................................................................................................;.....N.................".....2.................-.....C.......................+.....w.......................<.............................E.....j.................4.....i.................".....S.....a.................#.....3.............................i.......................\.............................6.....U....._.............................e.......................F.............................V.............................>.....I.............................l.......................g.......................).....e.......................+.....M.....\.................5.....[.............................Z.......................?.......................;.......................`.......................a.......................+.....i.......................C ....t

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\en-US.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\en-XA.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1031027
                                                                                                                                                                                                                        Entropy (8bit):5.210875521790238
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24576:HmdiMRfFgJWHLboEFFRyYHiLNQTCvXTOnXv1x7S6a8wGi4ADjn1VtuYtP01+Z5zp:H/sm5z9v
                                                                                                                                                                                                                        MD5:D5A14353A7FCC1F199F9234BD4551FF9
                                                                                                                                                                                                                        SHA1:7476E2846B6C0D03338A074D7FE325BB468992FE
                                                                                                                                                                                                                        SHA-256:E5CFEBD81831A65CA268866A8EEADB334F64FA3B0853BD550E5BB69724408FBC
                                                                                                                                                                                                                        SHA-512:BCE4FB535509834EA32ACBA72FC22B76CE591F9B6C1C15207B023460F59E9BC6F65118F816A82D235E7F20E26BF822EA102C95B5DA71FCFF099D56215945BD27
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........&g.e.....h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....|.....}.........................................................................8.....[.............................k...........t.....=.............................f.................J.......................t.......................a.......................g.............................]...........i.............................P.......................q........................ ..... ..... .....!....."....O"....y".....#.....#.....$..../$.....$.....%.....%.....%.....&.....'.....(....[(....%).....)....a*.....*....C+.....,....s,.....,....R-..........~...........X/.....0....~0.....0.....1....x2.....3....M3.....4.....4.....5....J5.....6.....6.....7....J7.....8.....8....!9....K9....2:.....:....q;.....;....z<.....=....L=....r=....U>.....?....|?.....?.....@....EA.....A.....B....,C....8D.....D...."E....!F.....F....zG.....G.....H....dI.....I.....I.....J....RK.....K.....K.....L.....M.....N

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\en-XA.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\es-419.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):560321
                                                                                                                                                                                                                        Entropy (8bit):5.366866302767652
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:jjxzJ7FnfONzx0T8puYnKwoR5g6qLFYUudBm+u:nP8/pQj5g64F4Tu
                                                                                                                                                                                                                        MD5:AAB525A7681AE93791B283205064E2B4
                                                                                                                                                                                                                        SHA1:A021DBDCD3F269B77D7133F47B63906FFF794F76
                                                                                                                                                                                                                        SHA-256:5EF4BB4558102F2E39669208BECE79FD5B474E0A87C8A1EED5BCD6B13DA6C6FA
                                                                                                                                                                                                                        SHA-512:841CD903FCF716692FF1873EDAC4FEB5F8B907AFEC1D0DEBFABB39255A74B9B2096FAE3E562E95893DAC731EF46D07B12B6A441975042981CC88638B7673B435
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.*...w.7...y.=...z.L...|.R...}.d.....l.....q.....y.........................................................................................v.................i.................Z...........7.....U...........B.......................B.....l.................<.....d.....u...........o.................n...........".....L...........).....n.................V.................)...................................j.................(.....W.....r.................K.....Z.................R.....h...........E.......................a.......................W.......................<.....l.....v...........D.........................................Y.......................c.................J.......................r...........) ....j ..... .....!....?!....Y!.....!....."....O"....h"....."....5#.....#.....#....*$.....$.....%....(%.....%.....&....z&.....&....#'.....'.....'.....'....5(.....(.....(.....(....7).....).....).....*

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\es-419.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\es.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):559178
                                                                                                                                                                                                                        Entropy (8bit):5.34611084339133
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:tMTZMKZuHswv12Jp/bNg86ip3+UxojFtnj45vzr700Iu96PZrk8jb:AZMKUGVVLpzojTnj45brY0sb
                                                                                                                                                                                                                        MD5:078BD56804D26C26E9AA4F41BF6549F6
                                                                                                                                                                                                                        SHA1:B1B575D34769F35CF28158BCB40C92264DECC551
                                                                                                                                                                                                                        SHA-256:99389110A1497D3999E8CB5799A629A471D221E07C2818CEFEEDB1C95BF5A9F3
                                                                                                                                                                                                                        SHA-512:4108B3BDED940A7D3939EE68DD489A4453391BAE548285867B81A50217C248280111853A1EB6838B6C079A01A74D11CEE61E7F441CBC6D7BA91F1DFAE3EE602F
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t."...v.7...w.D...y.J...z.Y...|._...}.q.....y.....~.........................................................................................+.........................................v...........f.................c.......................u.......................v.................7...................................V.....t...........L.......................p.................@.............................#.....q.................K.....~.................@.....h.....w...........:.....p.................R.......................M.......................:.....k.....v.................N.....X.................E.....U...........C.......................Z.......................T.....{...................................A.................1 ..... ..... .....!.....!.....!.....!....."....."....."....."....>#....X#.....#....l$.....$.....$....o%.....%....:&....c&.....&....F'.....'.....'.....'....@(....f(....y(.....(....J).....)

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\es.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\et.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):509452
                                                                                                                                                                                                                        Entropy (8bit):5.455817407928288
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:Z0izVKnUJ1HNRSUSx+DuM/Fb0WmFosQ4Eqsoh7Pwiw4dQH5ejnrlvCKMvaKWcEzn:vVKi7S65JmFosZtQH5ejJsW
                                                                                                                                                                                                                        MD5:45E28E64378FABED845EB242A8F1563D
                                                                                                                                                                                                                        SHA1:8FAA0651CA0D29596CA294DC448CB870D553C0FF
                                                                                                                                                                                                                        SHA-256:68386C75B1E414B5F94E1AA5EB9A98A42B6298177FABB834A8B9E96E1EF70A2D
                                                                                                                                                                                                                        SHA-512:3165EC45C2958C382832E4528D38966C28CA90C84777FD48D762FBD75F31FD52BD1B2C069BA4644504913219FAD5DDC08980F69DC67B9AB03D392AFC1321C339
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........:&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.!...s.2...t.;...v.P...w.]...y.c...z.r...|.x...}...............................................................................................................................t.................&.......................I.......................I.......................;.......................=.......................M.......................w.......................{.................'.................).....A...........6.....{.................W.....y.................=.....`.....l...........!.....K.....[...........).....c.....n...........5.....o.....}...........6.....g.....o.........../.....b.....q...........0.....d.....l...........T.......................U.....t.................H.....l.................<.....t.................I.....}.................L.....f.....w...........;.....c.....{...........G ..... ..... .....!.....!.....!.....!.....".....#....I#....n#.....#....J$.....$.....$.....$....-%....I%....]%.....%....+&....Y&

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\et.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\fa.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):825360
                                                                                                                                                                                                                        Entropy (8bit):5.0557125829631335
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24576:FqvG8u313uyqoT+s1qLpRmX1loT4RmdAQifaQ2XxFMJGk620dri1HMX9O9xdpxHk:Evpu55M
                                                                                                                                                                                                                        MD5:A13029CB1D5873121E6BDD0929A6C772
                                                                                                                                                                                                                        SHA1:7B88AE77DF959B8C01F5F00F2B0DFC30ED0A85EA
                                                                                                                                                                                                                        SHA-256:2527D1821D08E43D2F1259A1F910AF986632B8AEF9257D2FC37BC285AF7EE217
                                                                                                                                                                                                                        SHA-512:AF272D021316A71CF2A98126AF9CA993122B3B7B766C6D34003BCDC2FC5936BC4FAE95293B1D74FE35A0C81150D45E95ADABC4B34118974D214049FCDBEE74CA
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........%p.e.....h.....i.....j.....k.*...l.5...n.=...o.B...p.O...q.U...r.a...s.r...t.{...v.....w.....y.....z.....|.....}...................................................................%.....A.....k...........w.....H.......................M.......................]...............................................K.................=...........#.....D...........}.......................O.................Y...........E.....a.................................................................*.....N...........W.................,.............................!.....c.....z...................................@ ..... ..... .....!.....!.....!.....!.....".....#....R#....t#.....$.....$.....$.....$.....%....I&.....&.....&....L'.....'.....'....!(.....(....h).....).....)....}*.....+....j+.....+....>,.....,..../-....u-.....-....k.................e/.....0....a0.....0....&1.....1.....2....%2....#3.....4.....4.....4.....5....N6.....6.....6.....7....98.....8.....8....39.....9.....9.....9.....:....G;.....;.....;

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\fa.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\fi.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):517467
                                                                                                                                                                                                                        Entropy (8bit):5.424845538875905
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:RKUtqd19KJOKu4ar5HZ7kfCHEpyWaZ7WYM:Ntq8S5HFHAl
                                                                                                                                                                                                                        MD5:E7B72F44D711DECE8E3043173A553AC4
                                                                                                                                                                                                                        SHA1:892424E4E011AAC47B068F9FD929B5E41BCCA525
                                                                                                                                                                                                                        SHA-256:5F1A9DF87400AF56F748026F3BAAA41756A4C42FCE4791AABFE2087441689340
                                                                                                                                                                                                                        SHA-512:A2907B8E12CCDD0FC5601C37F23CCD5556B4EAE18CB1833481D01B39B30EC643167B0C8295EC9EE8CE851B0C7968E83F9C47C6E1D4543A371A62485D1832835A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........%..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....|.....}.....................................................................................'.....@...........E.......................s.................(.......................O.......................Y.......................7.............................\.........................................9.......................5.......................8.......................X.................&.............................[.......................!.....k.......................;.....e.....o.................N.....[.................#...................................l.......................a.................0.....~.......................K.......................A.......................?.......................I.............................f.......................^.................7.................................... ....2 ..... ..... .....!.....!....p!.....!.....!.....!....7"....."....."

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\fi.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\fil.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):584976
                                                                                                                                                                                                                        Entropy (8bit):5.195604084490558
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:4ln56kcajNxYUC36tIQy7DQEuq2V8L0dnGNLmG5eXmi1YARFtK:KnAkcmqnxEG5omt
                                                                                                                                                                                                                        MD5:F7F3CC17509AF03E639E983A091C2026
                                                                                                                                                                                                                        SHA1:D36E61E50B5FA99BE2A3C3727AFEB142969C8308
                                                                                                                                                                                                                        SHA-256:5D586C9BFA38452CDFB50BF5D2E9B98E68A8E7CC73E4D641D8FD6BB3E7EC5712
                                                                                                                                                                                                                        SHA-512:5A2C037D0AFDC82A4ECA642F43CC10E0040B7F97BE9DA14A8F806970C1E07BEC9CD69AD816A91A41946F35FF7A760ACC65DF21F6CD9D365ACBBA345FF0C1FF70
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...|.W...}.i.....q.....v.....~...................................................................................-.................(.............................4.................5.......................h.......................u.................+...........+.....i...........+.................#.................[.....q...........[.................1.............................5.......................s.......................i.......................R.....|.................h.........................................&.......................(.......................).......................M........... .....=................./.....M.................. ....! ..... ..... .....!....2!.....!....'"....n".....".....#....l#.....#.....#....&$.....$.....$.....$....j%.....%.....&....A&.....&....u'.....'.....'.....(.....)....S).....).....)....d*.....*.....*.....+....j+.....+.....+....",.....,.....,

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\fil.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\fr.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):606342
                                                                                                                                                                                                                        Entropy (8bit):5.380118288987104
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:n2sEZLqUMDpDgEL6QuaMVWXKz05qlZQmZyMYnYtkL09ujzxRe5hxkJSW7v40wCJ/:zj2VIN5JL
                                                                                                                                                                                                                        MD5:326917C8F37FE85E58AD3DE991D17A78
                                                                                                                                                                                                                        SHA1:683ED0FB95F33DC2B095E774AD3DE84B0E4A63E3
                                                                                                                                                                                                                        SHA-256:CFA45E5F86F70AE4D47D82BCEC6C245E618212E67CE8B7BF0A1BE0BE41C6E6E8
                                                                                                                                                                                                                        SHA-512:3FDF2B1C8031A06D5140449E22861545CC80E1417A70558DB2ACAC25733AC156A0D7941B053A7CFFB2ED193BBE5E0CAE4F1F68437FA570C612BE606DD10ECAE1
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........&<.e.h...h.l...i.}...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z. ...|.&...}.8.....@.....E.....M.....U.....].....d.....k.....r.....s.....t.....v.............................Z...........z...................................k...........P.....l...........G.......................x.........................................c.................>...........).....l.................n.................&.......................\.................-...........Q................./.......................0.......................*.......................B.......................[.......................^.......................K.......................D.......................o...........S.....j...........0.....^.....|.................4.....R.................X.....t...... ..... ..... .....!....[!.....!.....!.....!....[".....".....#....!#.....#.....$....Z$....z$.....$....x%.....%.....%....f&.....&.....'....>'.....'....I(.....(.....(.....)....^).....).....).....*.....*.....*

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\fr.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\gu.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1177779
                                                                                                                                                                                                                        Entropy (8bit):4.338116428198543
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3072:C3T12vbLPxCoYITYsRvc38ZUd02GHIwjAwREJKVMjNiT7llj63rhJXlPCKMi5eWt:dTbYITncQi02JCWJL5DAhc2T2
                                                                                                                                                                                                                        MD5:D77AEE1AB6AF4FC83813A69D3CA61E46
                                                                                                                                                                                                                        SHA1:C0786021AF8C8BBB083E9C4104B68BD28537893A
                                                                                                                                                                                                                        SHA-256:5D5E20C5F0CA21D8F1824EEBE8E595FAD4D0E601B224F4433B355A21B643971F
                                                                                                                                                                                                                        SHA-512:78C2589BC37594236D5B01C4C6C0CB934CF9CCAE15679159E1BCE64E3F5A3C903F9F7127D0DA8C317FD085A70EDFFDCAC413B4F2627BF14B862794B47BBA042A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.;...w.H...y.N...z.]...|.c...}.u.....}.............................................................................(.....`.................j.................Z.................F.....).............................#.....L...................................=.......................U...............................................|.............................E.....q.....n.....i...........+.....N.....\ .....!....D!.....!....n".....".....".....#....H$.....$.....$....O%.....%....?&....X&....$'.....'....=(....h(....$).....)....?*....a*.....+.....+.....,....),.....,....}-.....-.....-..........S/...../...../.....0.....1.....2.....2.....3....74.....4.....4....;5.....5.....5.....6.....6.....7....08....V8....a9....,:.....:.....;.....;....s<.....<.....<.....=.....>.....>....)?....)@.....@....mA.....A.....B.....C.....D.....D.....E.....F....vG.....G.....H.....I.....I....*J.....J.....K.....L....4L....SM....0N.....N

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\gu.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\he.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):728589
                                                                                                                                                                                                                        Entropy (8bit):4.658856122190603
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:W5SDjhr3FluYMy31frspm29Wqu/kQl4JACVXbfeQCajLn5l67co+oiNB05elmmdi:W5SdY5/oP
                                                                                                                                                                                                                        MD5:04C846A7F65C1E95E49CFE69EC9EEB45
                                                                                                                                                                                                                        SHA1:78142FD5545EE76B1F90FF5DF6FB7C01D797F3D1
                                                                                                                                                                                                                        SHA-256:AFAFB0DADD253E7F665FCB0D9D562D243E32D774B6ABDF602B66734F310E689B
                                                                                                                                                                                                                        SHA-512:029F45EE02DAD7D3431B223F5516937E34D685026488BA2DBF7C43FFDEDD1240FA119C349E4F5052CA3FDE109215D6D8813A43297A7E4EDB5D9B063192AC775A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........%N.e.D...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.............!.....).....1.....9.....@.....G.....N.....O.....P.....R.....i.......................}.....3.................g...........%.....>.........................................a.................x.................E...................................=.....m.........................................s...................................q...........8.....Q.......................E...........+.....V.................m.................I...........!.....8...........*.....j.....}...........s.................B.......................s........... .....3.................\.....o...... ..... ..... .....!.....!.....!....."....?".....".....#....>#....b#.....#....Y$.....$.....$....g%.....%...."&...._&.....&....''....H'....a'.....'....D(....u(.....(....4).....).....).....*.....*.....+.... ,....D,.....,....l-.....-.....-.........../....b/...../.....0....u0.....0.....0....~1.....2....k2

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\he.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\hi.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1250127
                                                                                                                                                                                                                        Entropy (8bit):4.3103395858193565
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3072:AubcffOrA0yUdRSM7vyWYfbXpgTMoV/BB0ZV1d1AuxXRLiW3Jk1eTByntDPtDl+U:AuAf2E0yjUv3MlgTMJem05f5xhbv
                                                                                                                                                                                                                        MD5:114BBD0D21C90DDFCE1D6E26432B7B9C
                                                                                                                                                                                                                        SHA1:EBFC476B4D742D9FDF5D0E78996748497EB0B4FF
                                                                                                                                                                                                                        SHA-256:E2321752811548A92EF069E53ABE349CAA93BE5596A2579DDE65391EE7CF915B
                                                                                                                                                                                                                        SHA-512:6195FC185F8297CA1C38B79339F86F0788B342A90B0E98F1ED5883CBE61725000B1653E911EB749351BB74802B8E75199DCF0C95D903A4422755E809A6A1814D
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........%_.e."...h.&...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................%.....,.....-...........0.....R.....w.....................................................g.............................8.....+.............................6.................~...........y.................+.............................8...........^..... .......................W.......................................... ..... .....!.....!....."....y#.....#.....#.....$....b%.....%.....%....s&.....'....M'....f'....=(.....(....b).....)....R*.....+....d+.....+....3,.....,....3-....O-.....-................./...../.....0.....0.....0.....2.....2.....3.....3....x4....#5....p5.....5....76.....6.....6.....7.....7....n8.....8.....9.....:.....:....A;.....;....O<.....<.....=....]=....Q>....-?.....?.....?.....@.....A....BB....zB.....C.....E.....E....+F....9G.....H.....H.....H.....J.....J....~K.....K.....L.....M.....M....:N....7O.....P.....P

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\hi.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\hr.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):562949
                                                                                                                                                                                                                        Entropy (8bit):5.503469092776888
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3072:5pEDgLd6TlZ/9yZuYUapEXgaBV08L7SkK7D+wwWrDfB+uhAxqOSAq6+xMcwd0uPJ:HEDjTMzU0EV7xHwPBhbKBc5ag7yIjR/K
                                                                                                                                                                                                                        MD5:54308E58D399D0F1C4E66A4A4B6E3B59
                                                                                                                                                                                                                        SHA1:8DFCE74D45801654531C78E34CF6A6C2E4BA5556
                                                                                                                                                                                                                        SHA-256:8141D126CD8ED7CD29B998E4A778E81AEC043BC126B5D2B0FB62F95C5FBF1F62
                                                                                                                                                                                                                        SHA-512:33C74ACE0F430D2E7963512075007DCA70ADCDD43FCE31A27F925351CEB00CFECE329EC5E9B60DACFF7E28DA322FC9CEFF3FCD9AE3A7BB6655400F1A580C3EA2
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........F&..e.....h.....i.....j.....k.....l.....n.....o.....p.'...q.-...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.......................................................................................................C.................0.......................c...........#.....B.................R.....h...........".....T.....d.................2.....B.................G.....l...........i.................D.......................k...................................L.....g.............................e.......................C.............................U.....v.................I.......................D.....r.................L.......................A.....l.....|...........'.....T.....d...........T.......................Z.....|.................@....._.................(.....U.....l...........K.......................m.................. ....u ..... ..... ....G!.....!.....!.....".....".....#....t#.....#.....$....n$.....$.....$....9%.....%.....%.....%....'&....p&.....&.....&.....'....|'.....'

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\hr.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\hu.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):605952
                                                                                                                                                                                                                        Entropy (8bit):5.638270541961174
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:n0L6iTfLsgtbgq0LcP9wHs8DfcAujkatvV5RvBFZfpduYG3b7ZNIeHK9njDi59Rj:iTfrtcFQA0V5RvBn0zzKY5u0vv
                                                                                                                                                                                                                        MD5:B7AA52653BBABCC713A03067E6FCFCC3
                                                                                                                                                                                                                        SHA1:B18CC0B968C4C0F156E33F5C493E6C09760161DD
                                                                                                                                                                                                                        SHA-256:244BE241E2FD68882ADB0C1A1C4AE93B1406AE22CCC14BCB37FC09FE3C2831A5
                                                                                                                                                                                                                        SHA-512:CB393247F79F1A6CDD685AD9729D0C7FD3BFADB5591CD822A4F92BA19448E50C148517DC0DDC14C37243CC0145A5AB17D27C45CCEBDCCB76CEC70C1B444D07C0
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........&L.e.H...h.L...i.]...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....W.....g.....}.................T...........u...................................f...........L.....f...........^.........................................(.......................{...........-.....^.............................s...........(.....:...........!.....c.....s...........v.................k...........W.....v...........j.........................................).......................q...........M.....d...........n.................>.................+.................W.....l...........r.................C...........(.....>..........." ....I ....e ..... ....0!....\!.....!.....!....L"....."....."....4#.....#.....#....&$.....$.....$.....$.....%.....%.....%.....&.....&.....&.....'....c'.....'.....(.....(....%)....4).....)....[*.....*.....*....s+.....+....:,....V,.....,....$-....U-....q-.....-....b.......

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\hu.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\id.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):500354
                                                                                                                                                                                                                        Entropy (8bit):5.374540321275158
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:HDTG/Veh932Bmcwf/yG+wFZf+MVnjHF3mmi8IxZ5GZhWwkK5cTSzo7IEji4JHw:HHG8h94sXyMFTVnjHFWmNIb5GZhow
                                                                                                                                                                                                                        MD5:0EFA0011CE0365AE4AFC08753F559098
                                                                                                                                                                                                                        SHA1:6AFC5115DFC222F0F2B2265A591B571803787DCA
                                                                                                                                                                                                                        SHA-256:A780C4E8E48CBDF2064CFF3E9E025103739B3763E3B82DDD99C97DFFF8FB1CE2
                                                                                                                                                                                                                        SHA-512:21C34901F5260606F14FE0E004851AF4DFA6960C28872417FB995ADAC4B2652609D9C0F5F30C0F76F4287217ADCDC0ACF1545CBD4E5A6F4B15565668840BCB75
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................@.......................`.......................Q.......................m.......................p.......................N.......................8.......................@.......................4............................._......................._.................!.......................(.....e.......................$.....I.....U.......................!.....|.......................c.......................>.............................e.......................L.....~.................?.....u.......................(.....9.............................b.......................C.......................'.....c.....}.................=.....k.....z...........6.....r...................................Y.......................l.......................B ..... ..... ..... .....!....q!.....!

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\id.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\it.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):558299
                                                                                                                                                                                                                        Entropy (8bit):5.272942823509238
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:qrF11tFO6w7oWhI7xO2/IJ/jNLiISIqRRRsO1StiRT9TjexKqcQxLcaPpzHi9fLN:u1tFFehoXFZxR8g26sjoh59koF
                                                                                                                                                                                                                        MD5:12FFE0FC0BE1B4134F219BD3B6D8F550
                                                                                                                                                                                                                        SHA1:DC14159AEA6643FEED260C3E3EB9BF4286FFFD9C
                                                                                                                                                                                                                        SHA-256:4FFAADC42BB0F78B78061EEC23B39BEBF34BA3B9B4F2CD0415FD3C94B2C828D3
                                                                                                                                                                                                                        SHA-512:423EB3AA074617C8FB64EA909CF860C8706B73B5CBC97D85D21E9298DC53CF9451DECCB1DE45B19377E8E2461D78282D587264340BCE8F487AD48B0DDEE55123
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........)&$.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...|.V...}.h.....p.....u.....}.........................................................................................w.................X.................2.................'.................g.................(.....O.....].................$.....3.................L.....v...........n.................X.......................y.................".................?.....X...........R.................'.....s.......................W....................... .....G.....R.................\.....n.................J.....U................. .....).....x.......................Q.......................Z.................,.............................U.............................d.................(.......................c.......................>.....|.................J ..... ..... .....!.....!..../"....."....."....<#.....#.....#.....$.....$.....%....W%....m%.....%.....%.....&..../&.....&.....&....:'

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\it.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ja.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):677279
                                                                                                                                                                                                                        Entropy (8bit):5.7261443457831875
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:5mNTLdjIcq5eHWv0WSGRBZ6Q2T+NbX5+Fo1Vi:5mNTxqe2ccBZ6Q2T+h5+FF
                                                                                                                                                                                                                        MD5:A92DA679A63FB99BB5F3BCF829168D21
                                                                                                                                                                                                                        SHA1:F15AA9BA6A952490DD881C82DED179FE03E50E80
                                                                                                                                                                                                                        SHA-256:F78FEB7523A3B4C795AC02EB66FD455B0F490257549D681B7AA07255E99AB9D9
                                                                                                                                                                                                                        SHA-512:3055528033206B6F32371A1BA05633614C0A3A9AF4FE2326FA3E6689BF535D5D540D926E08963FB668B02EEFF216DC2ECABED035C821C83E5D96CD2ED1531835
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........e%..e.....h.....i.....j.(...k.9...l.B...m.J...o._...p.l...q.r...v.~...w.....y.....z.....|.....}.....................................................................................1.....O.....p...........+.................'.................Z.....r...................................|.............................9.....K.................F.....V...........R.................@.................%.................8.....H...........#.....T.....c...........D.....{...........3...........5.....P.................6.....R...........S.................A.................*...........d.................`...........2.....A...........=.......................}.................P.................1...........j.................j............ ....: ..... .....!....Q!....r!.....!....^"....."....."....f#.....#....*$....d$.....$.....%....>%....M%.....%....R&.....&.....&....''.....'.....'.....'....z(.....).....).....).....*.....*.....*.....+.....+....1,....w,.....,.....-.....-.....-.....-....k...........4/....O/

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ja.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\kn.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1341496
                                                                                                                                                                                                                        Entropy (8bit):4.250874916501427
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:v/9cYunn57Dz6f03QIBR0UInI7L5IazUG4pt+h9lcQ:nCYu5i25PUS
                                                                                                                                                                                                                        MD5:F13C1631BB1E180C07CB10C5142CEC74
                                                                                                                                                                                                                        SHA1:BD3B971893D3CE2206EDD040ED0EAB9BA010BD18
                                                                                                                                                                                                                        SHA-256:3A63D9B5BDECE8442ACA6971771A660BCEAE995CA96394FA88B024FEF3C93BF7
                                                                                                                                                                                                                        SHA-512:9122A55CE0E09ADAFE0162337B518228441D9A852E68761BFB62B656415F25386B3DB41279699F8035BE3BB3EA003FCBA91B5D5FC6EC538EF79E9486A488280A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........M&..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....|.....}.........................................................................(....._.................j.......................A.....I...........X.........................................]...........Y...........P...........q.....:.............................q...........2.....A...........y...........S...........".....1 .....!.....!.....!....)#....?$.....%....Q%.....&.....'.....(....@).....)....r*.....*.....*.....+....@,.....,.....,....U-.....-....>.....S.....6/...../....w0.....0.....1....?2.....2.....2.....3....B4.....4.....4.....5....p6.....6.....7.....7.....8.....9....@9....b:....a;....!<....P<....3=.....=....Q>.....>....>?.....?.....@....,@.....A.....A.....B....`B.....C....PD.....D....eE....MF.....F....RG.....G.....H.....I....'J....yJ.....K.....L....TM.....M....(O.....P.....Q.....Q....8S....6T.....T....lU.....V.....W..../X....|X....IY.....Y....\Z.....Z.....[.....\....]]

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\kn.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ko.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):569413
                                                                                                                                                                                                                        Entropy (8bit):6.084713993678112
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:OA7Ny//OV2Ngi7QFIyjxMSVG0GTin8t8OQ4E3hvaYrSCqD5tEp7YqGT8U13Xq7hy:OA7Ny/oZO5L8frCT
                                                                                                                                                                                                                        MD5:E8448C3D352C76C1C0F2B9F508852D9A
                                                                                                                                                                                                                        SHA1:2B7FE9F0A49FE3428E467A4214D0E7EC79CF7B52
                                                                                                                                                                                                                        SHA-256:30D515F2E086A7773DD3C7B5E6504729B6D91D9FA7174C3226EB3553F900BBF2
                                                                                                                                                                                                                        SHA-512:AE4144323E7EB2C2C97F336EE144C0C739CB5500F7FF382469CB4CE33DBAE35078EACD85F50381912C9D4367DFC9CBCB6C7C7BCE8314A0351B14F950A2209184
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........>%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s./...t.8...y.M...z.\...|.b...}.t.....|.....................................................................................................A....._...........8.....y.................p.................3.......................Q.......................V.......................e.......................v.................+.......................!...............................................+.................{.................D.....h.................%.....J.....Z.................%.....5.................W.....s...........7.....k.....{...........B.....v.................E.....u.................C.....t.................y.................:.......................*.......................5.......................O.................#.....t.......................?.......................B.......................U............ ....& ..... ..... ....0!....G!.....!....."....>"....Q".....".....#....$#....7#.....#.....#....($....;$.....$

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ko.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\lt.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):611429
                                                                                                                                                                                                                        Entropy (8bit):5.6299671018290445
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:QQtetgAZbMAUbgO9aG1DT/G57szII1JgNf6SMM:QDgiMQzOG55IngN/
                                                                                                                                                                                                                        MD5:F6F5B593C91B7820C9552FFDDFAC03FC
                                                                                                                                                                                                                        SHA1:D771AC14A49C7654043D0AE2DC52239BF4636F65
                                                                                                                                                                                                                        SHA-256:FFE7EAC4BC39085977C28BF8BA0060B9A12471C3914A30DF1C46305926242BB6
                                                                                                                                                                                                                        SHA-512:45D3580D456F6972259055BFFEDE8745C922DFE2703BCF3A545E73211164E3CA594A56330A2A17EC373AB060C05A7776D88DFBAB5014081948A5F89A849F793C
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................v...........d...............................................i.................z.................D...................................?.....V...........P.................3...................................D.....U...........C.....}........... .............................&.....t.................t.................#.......................N...................................E.....X...........L........................................._.................(.................C.....Q.............................h............ ....( ..... ....9!....s!.....!....."....."....."....."....m#.....#....*$....]$.....$....4%....V%....i%.....&.....&.....&.....&.....'.....(....J(....n(.....).....).....*....!*.....*....*+....h+.....+....&,.....,.....,.....-....j-.....-.....-................./....Z/

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\lt.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\lv.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):610750
                                                                                                                                                                                                                        Entropy (8bit):5.626685122127425
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:IbsBLMwr28cTB6aTmNstVFpM6Y97vccj/kbO153ySAbEwT4757esFOHAYXSIENAs:FL8PXVY9rrV15SEwTW5tOmAhm
                                                                                                                                                                                                                        MD5:8D8244CEA7D00E7502CFC62908147BB7
                                                                                                                                                                                                                        SHA1:2ECF5C264208555EC5BD4530544CC0AEE99F558F
                                                                                                                                                                                                                        SHA-256:C9722A6B132E9EF5BCA53565BCBC2CB3C40CB8954F2286250AD15FAFC0D2DCC1
                                                                                                                                                                                                                        SHA-512:B5B98ADE8D7EA25477D12CBEB6B1F07FEC5625583B8CC695755195B1EEF0D380C72AE4609955D230B4FD6109AA6B778421E7EAE9D7086FEC03CFF93C93D91791
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........J&..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.R...t.[...v.p...w.}...y.....z.....|.....}.....................................................................................$.....@....................... .................T.....g.........................................Y.....x...........W.........................................O................. ...........e.................H.............................&....._.....r...................................*.....z.................f.......................o.......................}.................5.................$.................:.....L...........:.....q.................i...............................................#.....u.................P ....k ..... ..... .....!.....!.....!....5"....."....."....."....j#.....#....:$....t$.....$....A%....a%....z%.....%....~&.....&.....&....J'.....'.....(....%(.....(....|).....).....)....z*.....*....5+....[+.....+....V,.....,.....,.....-....r-.....-.....-....4............/

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\lv.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ml.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1394062
                                                                                                                                                                                                                        Entropy (8bit):4.285571867304228
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:MYNjRdBR8QA2cMmsbbAx4LJxFq/ixn9mMy6UQ6KfUBp/AZCBEmeyo3ewhp5O47uW:RZRltMTKfUBpUyo3eo5O47xs4+3e
                                                                                                                                                                                                                        MD5:979090995F7F9DBFA9FA9A96349DA745
                                                                                                                                                                                                                        SHA1:6D9425EB6D3FF6B433A2FFD89DFFB3AEDCDE3588
                                                                                                                                                                                                                        SHA-256:C27AC1727F3A3A25ABED09CBF07DA604DD1C42A1855851E63DFCDC9831091EDD
                                                                                                                                                                                                                        SHA-512:4D734D7903DD4C39A2392EDA7B6A65929E61FE105ED843718D5CAF8D93DA9FF14A8908B896425335FCE9CA5AE717C29C80E7D85A2A6B80DF9F4FAC8F7A558F38
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........G&..e.....h.....i.....j.....k.....l.....n.....o.....p.)...q./...r.;...s.L...t.U...v.j...w.w...y.}...z.....|.....}...............................................................................b.................T...............................................c.................................................................\.....M...................................8............................................................ .....!....s".....".....#.....%.....%.....&.....'.....(.....)....2*.....*.....+.....+.....,.....,.....-....".....P....../...../....40....h0....J1.....2.....2.....2.....3....I4.....4.....4.....5.....6....#7....W7....C8.....9.....9.....9.....:....i;.....;.....<.....=....?>.....?....C?....-@.....@...._A.....A....\B.....C....PC.....C....nD....;E.....E.....F....BG....*H.....H....HI....,J.....J....TK.....K.....L.....M....NN.....N.....O.....P....IQ.....Q.....R.....S.....T.....T....&V....-W.....W....=X....kY....fZ.....[....Y[....J\...."].....].....]....+_....:`.....a

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ml.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\mr.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1147816
                                                                                                                                                                                                                        Entropy (8bit):4.319695697825778
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:p+xh0ke1h+Fnhb0paSpgKZmTDAyyLj5QpYGde:p+TUA0paSppZ+Ayyf5QpYGde
                                                                                                                                                                                                                        MD5:7862ABEC5008FAC0A8924B65B3058C05
                                                                                                                                                                                                                        SHA1:BC6A3F405835E3F3290CB521CA2A9AC85EAECDC4
                                                                                                                                                                                                                        SHA-256:44056C45DE472FF1A5037FC24CC2417218CF4FA500B6A7158BD8AA221268B69F
                                                                                                                                                                                                                        SHA-512:C91A1DCC08EAECF7F99B37684E02F3F89D18DBAF24B2BF3849CE78965A38E8A995ABBA03C0F8F20420AA15519439F0C662165BAA6A31BFE3CF994AA51F67C8F8
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........%O.e.B...h.F...i.`...j.l...k.{...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......#.....(.....0.....8.....@.....G.....N.....U.....V.....W.....\.....~.......................c...........Y...................................$.....Q.....'.....x.....~.....{...........4.................".....d.....0...........d.................l...........&.............................%.....(........................ ..... ..... ....."....3#.....#.....$.....%.....&.....'.....'.....(.....).....*....E*.....+.....+.....+....),.....,.....-.....-.....-.........../.....0....f0....N1....$2.....2.....2.....3....G4.....4.....4.....5....G6.....6.....6.....7....Z8.....8.....8....$:....M;.....<....N<.....=.....=.....>..../>.....>....t?.....?.....?.....@....^A.....A.....A....&C....!D.....D....7E....!F.....F....?G.....G.....H.....I....=J....~J.....K.....L....@M....sM.....N....#P.....Q....3Q.....R.....S....1T.....T.....U.....V.....W..../W.....X.....X....)Y....RY....sZ....g[.....[

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\mr.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ms.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):524044
                                                                                                                                                                                                                        Entropy (8bit):5.251286724342732
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:SgRSValNdUMLjehAr7nQjBx7+27fldjiMIUcGm95AIHxOMVLLEWVHs:SOSmu0jeAnEx7BldPc95n0Mu
                                                                                                                                                                                                                        MD5:5EE8AEFF66C42600D73F9CB7D8366CCE
                                                                                                                                                                                                                        SHA1:DAB706F52B7F6099286D659EFC24ADBAD9F5A4F2
                                                                                                                                                                                                                        SHA-256:A87B9926FBC7C17D884ABE1D8E4B81335476B00FFE76196E38AF8542E2D7881D
                                                                                                                                                                                                                        SHA-512:96145B505C3726878162EF4AE328F08888F1CBCF3C3D8AADFCE4E72398651D1B120C4D219176E107F99BD682D968D3C8F02AA8BF600007033AAC07064127A8EA
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........S&..e.....h.....i.....j.....k.....l.....n.&...o.+...p.8...q.>...r.J...s.[...t.d...v.y...w.....y.....z.....|.....}.....................................................................................5.....L...........S.................'.......................;.......................m.................0.............................}.........................................*.................^.....v.................C.....L.................".....-.................&.....7...........(.....{.......................9.....K.............................i.......................O.......................\.......................U.......................E.......................5.......................C.......................f.......................N.......................).....u.......................^.......................>.....V.....b...........#.....T.....c...........0.....q............ ..... ..... ..... ....S!.....!.....!....."....k"....."....."....."....G#.....#.....#.....#.....$....o$.....$

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ms.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\nb.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):508553
                                                                                                                                                                                                                        Entropy (8bit):5.428763068409714
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:h63MVtpURb8w5Op7fQ9S8GNxRV5/n4FJFEWt:h63MVXUa65GNxRV5f4jFP
                                                                                                                                                                                                                        MD5:40B668B73BBF3575D009F3D528D388E5
                                                                                                                                                                                                                        SHA1:E7186E4796216615F388C8A8058D898C4913F2FD
                                                                                                                                                                                                                        SHA-256:8813FA272B1A12042C75B97848605C8DA7D306AC7AAA4F231D41EE98D9E70538
                                                                                                                                                                                                                        SHA-512:8858E78493FBDBE1B2B99BCE75DAAC585F40EEA2612D80D82850F7957F0EF69C3A1F3DC7C011427CB1E64CD667031DEBD3B3D160BB9C2146224377A99B74798A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........*&#.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...............................................................................................}.................[.................3.................!......................./.............................v.......................w.................&.................H.....k...........x.................R...................................S.....m.............................L.............................m.......................P.....u.................L.......................X.......................^.......................S.....|.................J.....x.................p.................&.....~.......................b.......................G.....i.....{...........h.................9.......................? ..... ..... ..... ....T!.....!.....!.....!....b".....".....#.....#.....#....+$....u$.....$.....%....f%.....%.....%.....%....A&....^&....l&.....&....6'....e'

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\nb.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\nl.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):525362
                                                                                                                                                                                                                        Entropy (8bit):5.366124885898627
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:TZpCbai+lbWusvbgQ5Pax5ttonxEGp7KY8OTy:3Cmi+lbWusB5Pax5tenxEGp7KYH2
                                                                                                                                                                                                                        MD5:6E38F51EBC9B4AF616C984ACFEF7323E
                                                                                                                                                                                                                        SHA1:1D871E09B051CDF1429FBB68FC43B7631DAD9438
                                                                                                                                                                                                                        SHA-256:E3ED1D14209965FACA5AC6A2B4026A4A28D21F5096E0C44943E731279190D540
                                                                                                                                                                                                                        SHA-512:4124F5ED6E9AC7701837AAE5458DB96DF8303FFF05ECBAB40D938CF0FDE3C5F2F696D07F0BE2227040A14336D2701F8A76342550419630F51C073070DC705492
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................U.................4.................@.....T...........;.......................c.......................[.......................?.....g.....u...........M.......................}.................4.......................=......................._.................(.................g.......................C.....W.......................$.....y.......................h.......................j.......................O.......................,.............................v.................,.......................N.......................?.......................".....x.................&.......................B.......................$.......................C.......................z ..... ....P!....a!.....!....O"....."....."....##.....#.....#.....#.....$....j$.....$.....$.....%....`%.....%

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\nl.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\pl.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):587942
                                                                                                                                                                                                                        Entropy (8bit):5.759897632158159
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:l2o5czDWoOB/kbwvGfQfR6HAEbFVP+CUdCe3mUUFMAmW1Qh4Mh5vJ14scsy:woGYabMe1Qhz5cR
                                                                                                                                                                                                                        MD5:2D6468A89698A05B8522F679825572D3
                                                                                                                                                                                                                        SHA1:52EC81BC896051ED8A865B44C58F82EABA6B89B9
                                                                                                                                                                                                                        SHA-256:477E505459C80A8477FA6EF1B8A0FAF16C5E450B69CF922C37BBE020A088E695
                                                                                                                                                                                                                        SHA-512:59A95F05D071C739D4DC1456B856D0283AD3D99AC35EC300EC38E76AB236BA6D6E83598D0823D46C07D62EE0457F2958C682F4EFA3EADB824A254F48387EC538
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:......../&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.#...v.8...w.E...y.K...z.Z...|.`...}.r.....z...............................................................................................(.......................{.................Z...........$.....B.................F.....\.................=.....Q.................P.....b...........9.....o...................................h.......................~.................&...........#.....n...................................w.......................7.............................I.....j.....x...........A.....z.................I.....|.................C.....t................./.....[.....k...........'.....[.....l...........V.......................U.....r.................2.....S.....y...........(.....i.....~...........P.................#.....i.................. ....Q ....w ..... .....!....p!.....!.....!....R".....".....#....,#.....#...."$....e$.....$.....$....J%....w%.....%.....%.....&....7&....F&.....&.....'....\'

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\pl.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\pt-BR.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):551569
                                                                                                                                                                                                                        Entropy (8bit):5.417670979179483
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:fl4UKe4ouC2NBXBL1WkoyVH5gcJBM90sRaY5K/:WzeRf+5TJ/sR15G
                                                                                                                                                                                                                        MD5:FBD585195E35E49C60A9190FBF815E86
                                                                                                                                                                                                                        SHA1:F88FE564784D0441A304A4B126DE27FB2B0412EE
                                                                                                                                                                                                                        SHA-256:ED647E78BC3E89A6322A7198DD1875034AC3CDA355BA6837EA0D4686D56712CD
                                                                                                                                                                                                                        SHA-512:22596E824D2226C8E0773F323FDDCB1A0C7523EE2077C38205EDB5B11EF15DE3C5768B8C598A781BDC49BE91C3B1B22BA92C3DA5E0BE6ACB5DF42670487E68E0
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s."...t.+...v.@...w.M...y.S...z.b...|.h...}.z.....................................................................................................).......................m.................I...........5.....R.................Q.....f.................6.....F.................%.....>...........2.....x...................................x...........$.....5.................:.....N...........<.................4.................$.....s.......................S.......................Q.......................T.......................W.......................9.............................g.......................\.................).......................^.......................-.....y.................P.....{...........$.................$.....p.................. ....T ....{ ..... .....!....^!.....!.....!....H".....".....#....2#.....#....3$....}$.....$.....%....Z%.....%.....%.....%....2&....X&....m&.....&....E'.....'.....'.....(

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\pt-BR.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\pt-PT.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):555353
                                                                                                                                                                                                                        Entropy (8bit):5.392038775374042
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:B2lInvsb1Nq9rX7YZieJVJJxhQ3shYfVh85IKlbSRDF:EAvsb3qdXj85IK1SRB
                                                                                                                                                                                                                        MD5:C64146716C2A401FEC538E4C79785144
                                                                                                                                                                                                                        SHA1:3C5D0B45225A39A65C0345E5C98A4E539D807FE1
                                                                                                                                                                                                                        SHA-256:904189CAAEF1E278EE31432F8995BFC150975250FA355683E1CEF1B5C79D3BF3
                                                                                                                                                                                                                        SHA-512:CE8336F4C83E47779169B3F875D8910F7C30CF7BCA2CF77C398C37E32FDC8C01A43B5EF74CFD03C3ABE8E3979454EBB1396CEA7449640025423D2B1F565A5C0C
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........I&..e.....h.....i.....j.....k.....l.....n.....o. ...p.-...q.3...r.?...s.P...t.Y...v.n...w.{...y.....z.....|.....}.....................................................................................".....4...........H.................&.......................u...........U.....p...........[.......................f.......................G.....t.................t.................Z.................2.................K.....X.................W.....g...........9.........................................e.......................P.......................H.......................X.......................`.......................K.......................$.....z.......................h.........................................H....................... .....`.....z.................O.....|.................o.................>........................ ....o ..... ..... ....*!....{!.....!.....!....i"....."....D#....\#.....#....L$.....$.....$....1%.....%.....%.....%....@&.....&.....&.....&....3'.....'.....'

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\pt-PT.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ro.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):574388
                                                                                                                                                                                                                        Entropy (8bit):5.451836104471441
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:NTIexSy0/AfWKXEjvyJe/FoMxOINkjK0yGZq5BZyo2cs2V/qE53:NTIeTOKXEuJUFoyO/u0zq5BAor/d3
                                                                                                                                                                                                                        MD5:C613CAB2C2D6AC5B88E21FCB65671F19
                                                                                                                                                                                                                        SHA1:291D545427FEAF8DA9DD75679ADA1BB70C66EB47
                                                                                                                                                                                                                        SHA-256:8EDD01CC74EB965CFA4CB35249097D114F554B8D80883D7C7E335A857F33A810
                                                                                                                                                                                                                        SHA-512:1E826936C1636F7D5DA9870DD362984E2DEDB8F3BFFE3F64D8615BC955F4A1C2E988E7FB60387743949C200DF073FBB7B27DC3B6A66BA9D7950571CA2DD2FE57
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...................................................................................{...........Y.....s...........4.....m...................................y...........$.....C.......................%.....|...................................".....S...........A.........................................P.......................g.................#...........3.......................U.....s.................&.....K....._.................$.....4.......................4.......................+.............................Y.......................8.......................S.................5.............................W.......................V.......................q.................\.......................$............ ....; ....V ..... .....!....Z!....o!.....!....l"....."....."....a#.....#.....$....7$.....$.....%....F%....^%.....%.....%.... &....6&.....&.....'....s'

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ro.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ru.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):941599
                                                                                                                                                                                                                        Entropy (8bit):4.851052751447414
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:tqeL4fQjRo4Y+5NMx/K69zJ9ZFdAal2a4qSGsN9z/0TYH8eXN2hVO3j/tSbzvMBS:tKgk5b6tS
                                                                                                                                                                                                                        MD5:36D9CBBB31930EB5B78378EC63751BE6
                                                                                                                                                                                                                        SHA1:5D123C38941CC4E59570254909291B29970F0CE1
                                                                                                                                                                                                                        SHA-256:DE90BA6507DC032C853FC61BDBF9218A29FF70379B571B1F4F3D7A28C3902479
                                                                                                                                                                                                                        SHA-512:EACCC7FBDF3E9D9C9EB1A602C1BF17C8BAFC920EBD058C4D2C496B95BB1B3FABCDFC87D1747BFD8CD404DE75C887038A99717BE7960BC808B632039EC9F80A06
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........%..e.H...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....s.............................P.......................2.......................c.......................!.....f...........O...........W.....z...........,.....p...........;...........-.....i.....\.............................,.....~...........Z...........;.....`.................B.....o.....s.....m...........<...........O.....|...........=.......................~.................9...........>.....w...........B............ ....A ..... ....D!.....!.....!....."....."....."....."....a#.....#.....$.... $....2%.....%....~&.....&....3'.....'.....'.....'....s(.....(.....(.....).....)....+*.....*.....*.....+....M,.....,.....-.....-.....-....%.....7...........f/...../...../.....0.....1.....1.....1.....2....A3.....3.....3.....4.....5....:6.....6....87.....7.....7.....8.....8.....9....E9....^9....6:.....:....S;

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ru.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\sk.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):592404
                                                                                                                                                                                                                        Entropy (8bit):5.807054231111397
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:phWgwEC/qsIkBr7iIip+RC5y+dbLxrQzLPxt9eH:zWR/qsx7iCC5NLaBtEH
                                                                                                                                                                                                                        MD5:59822645439846B0A211C8566E7CF90E
                                                                                                                                                                                                                        SHA1:F4EDAE1B34DF718FD72EBEBD6DC9E36CFEF95584
                                                                                                                                                                                                                        SHA-256:60319C30E94770472017E83ED0309A8F134F0D60E38261F53517EA23E9658C09
                                                                                                                                                                                                                        SHA-512:E2A7295BBFD5E721C765F90FAE0AD1420902A916E837E1B0BD564BB9EB553908EADEA58739F21D75C9F38CD3D1E821DCF14545884462FAA3F70617AFC764B84A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.%...t.....v.C...w.P...y.V...z.e...|.k...}.}.....................................................................................................S.................W.............................&.....u.................`......................................... .....z.................6...................................Q.....t...........k.................1.......................u.........../.....F...........k.................9.....................................................|.........................................S.......................h.......................y...........'.....:.................F.....Y...........s.................(.....v.......................Z.....v.................U.................- ..... ..... .....!....o!.....!.....!.....!....s".....".....".....#.....#.....#....@$....Z$.....$.....%.....%.....&.....&.....&....8'....Y'.....'....*(....Y(....m(.....(.....)....>)....R).....)....I*.....*

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\sk.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\sl.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):568760
                                                                                                                                                                                                                        Entropy (8bit):5.4785168337779435
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:1Hr7a+NC5qB2r+JpEE5U8c2JHvbxi/fz8lqc:1L+UC5fyEE5U8cAi/fz87
                                                                                                                                                                                                                        MD5:970F310ACBAFA4A29E0CFA5C979DF397
                                                                                                                                                                                                                        SHA1:B1C20EEFC61785C3CBAF7D6D3B5FD2B144CC1EF5
                                                                                                                                                                                                                        SHA-256:B4EFD0CE0957A00E2E617A3E595B471ADFDFBDEE333C14BA41B8DC8BB5653324
                                                                                                                                                                                                                        SHA-512:D1DF03814C42819F94A7CF3FA54D699AC8A844C69303CEAED97BA3D3512406161F011120395904B473EACA29D8959B9A14C85D90A880508611E80A46B9D97575
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................[...........=.....V...........,.....].....n...........z.................N.......................S.......................E.......................W...................................B.....c...........A.....{.................e.................1...................................l.................A.....X.....p...........".....E.....U.................:.....M...........0.....l.................G.....z.................q.................&.......................'.......................6.......................Z.......................B.......................9.......................`.................3.................. ..... ..... ..... .... !....4!.....!....."....D"....\".....#.....#.....$....1$.....$....f%.....%.....%....e&.....&.....&.....'....a'.....'.....'.....'....S(.....(.....(

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\sl.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\sr.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):872667
                                                                                                                                                                                                                        Entropy (8bit):4.788135484665425
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:i5s/IU2p79qWYZAYI8dlSDdrPuzQhrUPb7FW5fZPT0xT7xH47L37SjeUM/k/3:IsZhYIlW5exxB
                                                                                                                                                                                                                        MD5:5E439D9D281D90569CD4AA231FC8B287
                                                                                                                                                                                                                        SHA1:AA8D4E28770F430DD7F93E2B9879748A97C74FB0
                                                                                                                                                                                                                        SHA-256:9082215832960416F3E6B43D2F76869A8632506BFE3A806A1B46C858B1370806
                                                                                                                                                                                                                        SHA-512:C9491A35C082B1BB7C08B732D6F07DBFFA5BB955988141D3C56D3F482D9FA74763EB196AA7F37445808163AB790A0B23091C06F81EBACB94BD164DC72B01A71C
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........<&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...|.|...}.....................................................................................>.....s.....`.............................:.............................#.....W.................H.....}.....$.............................!.....h...........Q...........@.....{.....{.....9.......................a.......................A.......................e.................$.......................j.................3...........8.....r...........! ..... ..... ..... .....!....J"....."....."....}#.....$....R$....s$.....%.....%.....%.....%.....&.....'....Q'....r'.....(.....(.....(.....).....).....*.....+....3+.....+....9,....q,.....,....8-.....-.....-................Z/...../...../.....0....#1.....1.....1....z2.....2.....3....L3.....4.....4.....4.....5.....5....{6.....6....-7.....8.....8.....9.....9.....:....5;.....;.....;.....<....4=.....=.....=....2>.....>.....>.....>.....?....q@.....@

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\sr.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\sv.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):512705
                                                                                                                                                                                                                        Entropy (8bit):5.538975019723545
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:UoQDiRIZXEr1COYNcNUAvSrZxkmvZl1HI4RFcz9RyoxGOGW3IiRMaSOmDE/xWcqX:DQDRZXllNcGrjr5O57ze
                                                                                                                                                                                                                        MD5:D31FED9E04F8915045F6A2CC7BD4C9FE
                                                                                                                                                                                                                        SHA1:8C68186DC5463D4E45889E8DE021536110B09453
                                                                                                                                                                                                                        SHA-256:931598B71AD77874A64294614BA73B426A717F343674FCEB7BAEE227D4413B9D
                                                                                                                                                                                                                        SHA-512:3C9D2F8F655006722AC5B08E8575EDAC9CCE21061B3A8696B8E772734A12BBFE04C53838DEC475887DBC82501E90A8799ACE71DC49BA05CF766037D001852493
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........%V.e.4...h.8...i.I...j.U...k.d...l.o...n.w...o.|...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....S.....e.....y...................................Y...................................b.....{...........K.......................V.......................U.......................z.................L.................$.........................................8.....H...........D.................@.................M.......................".....z.......................W.......................K.......................X.......................M.......................=.......................4.......................?.......................T.......................-.....}.......................N.....o.................Y.................$.....z.......................k.................. ....a ..... ..... ....,!.....!....."...."".....".....#....I#....o#.....#....;$....k$....~$.....$.....%....6%....D%.....%.....&....1&

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\sv.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\sw.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):539452
                                                                                                                                                                                                                        Entropy (8bit):5.338235032300934
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:pGnHmfiscrB5G7CCRdCAUQbQW4243xaKFNUq89F1ggt45JUAcwg6yJMkJPe/Bmqa:pSoo5GH
                                                                                                                                                                                                                        MD5:F0314E8F5AF94C845AB4218468AF3454
                                                                                                                                                                                                                        SHA1:4ABFA3D5D114AE89CB449F83C1267DA3DB0EF8BE
                                                                                                                                                                                                                        SHA-256:0CE0651A673A250FA86E6A9DF4EC490C832F045E07617343F015599687AA84E8
                                                                                                                                                                                                                        SHA-512:11E6CA00ACD7D65495F7C04BA5E558DAAD835C48BD230F616DE62954B9E10FC45E816E049E1ADB858B29D335DA08808B560F04C8A6AED83B62ED722F1968C08F
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........)&$.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................u...........D.....Z...........).....h.....z...........m.................2.......................$.....w.......................\.......................f.................H.................,.................8.....H.......................<.................=.....Q...........`.................3.............................Q.....t.....}.................=.....I...........,.....w.................6.....j.....|...........@.....}.................0....._.....l...........&....._.....h...........L.......................^.......................h.................*.....z.................F.......................x.......................S.......................a ..... .....!....#!.....!....."....u".....".....#....k#.....#.....#....T$.....$.....%.....%.....%.....%.....&....,&.....&.....'....['

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\sw.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ta.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1387366
                                                                                                                                                                                                                        Entropy (8bit):4.061553280377292
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:cyu/keC6jicF5ZzVtR6cA25tm1vYpiMyg:Yj9F5ZzUcA25tm1vYpiMyg
                                                                                                                                                                                                                        MD5:4411E4698E279FB95ADEA7BE9625F800
                                                                                                                                                                                                                        SHA1:A3C655D334442CF5EF106B92F9778C9B3FBC252A
                                                                                                                                                                                                                        SHA-256:BEABEEA92C3FB9C52C22BADD99D686F1690E3574C75CD7A886320FB2CAC53D92
                                                                                                                                                                                                                        SHA-512:4406ADF5F7BEB86A49695FFF0A3E92E108AC2EE4DAAE46821C74164018FBD72E6D1DDA7C3B689B30A1F19C17B13B0C1BF0537C966ABE88137A0135D04483BF41
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........&7.e.r...h.v...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.*...|.0...}.B.....J.....O.....W....._.....g.....n.....u.....|.....}.....~.........................................{.....A.....j.............................n.......................5.....k...........9.....:.....-................................... .....X.....\...........G.......................#.....D.....Z ..... ....@!.....".....#....L$....}$.....%....&'.....'....U(.....).....+.....,....^,....a-....*.....~............/.....0.....0....-1.....2.....2....K3.....3.....4.....5....F6.....6.....7....z8.....8....-9.....:.....;....y;.....;.....<.....=.....>....<>....6?....'@.....@.....@..../B.....C....\D.....D.....E.....F.....F....4G.....H.....H....;I.....I....aJ....JK.....L....bL.....M.....N.....O.....O....yP....?Q.....Q.....Q.....S.....T.....T.....T....qV.....W....eX.....X.....Z.....\.....^....8^....._.....`....Va.....a....6c....\d.....e....me....qf....^g.....g.....h....Pi.....j.....k

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ta.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\te.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1281329
                                                                                                                                                                                                                        Entropy (8bit):4.31693967998977
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:lGfZBWX7McKNsC1ot59d4e/gb0HrWs05Bk3p1FZNViFlJ2wtg+NFqhrOlHXAAFwG:cxBWVZd57MkC
                                                                                                                                                                                                                        MD5:443D47F30632512C7E5A6E142D2A3CA3
                                                                                                                                                                                                                        SHA1:98730D4194266544C204E11E30C1817A5C8DFAE6
                                                                                                                                                                                                                        SHA-256:12267195833FF2F15F99947478C75EEB18923EB125AAF7118A0F398045636E33
                                                                                                                                                                                                                        SHA-512:34A02D50B300E8283A896BA492277FB6D2C16BFEEF88B30344C803D060DC50FA638BECA10F5113EBFE23D6E5882D82D072303112008FA721FF20EA087385C71C
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........I&..e.....h.....i.....j.....k.....l.....n.$...o.)...p.6...q.<...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................).....].........................................a.....S...........<.............................>.....W...........1.......................D.....S.....#.............................7.................D...........p.................0 ....q .....!....."....4#....w#.....$.....&.....'....I'.....(..../*.....+....i+....T,.....-....Y-.....-..........|/...../....(0....<1.....2....l2.....2.....3.....4....x5.....5.....7.....7....Z8.....8.....9.....:.....;....J;....i<....9=.....=.....=.....?.....?....d@.....@.....B.....B.....C.....C.....D.....E.....E....+F.....F.....G.....G.....G.....H....rI....3J....kJ.....K.....L....RM.....M.....N.....O.....O....LP.....Q....jR.....R....;S.....T....>U.....U....!V.....W.....Y.....Z.....Z....v\.....]....:^.....^.....`.....`.....a.....a.....b.....c.....d....Kd.....e.....f....Ng

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\te.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\th.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1076392
                                                                                                                                                                                                                        Entropy (8bit):4.3678914271676845
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:lk8N9LyZYAST4z1L/L1XPVLsbhRy1cW+v1H5UJEyL3ftj8wlz9eTRo98GkK9uLAR:lip5h5F
                                                                                                                                                                                                                        MD5:ABFAD720A09628E229EE75C14DCC1DEE
                                                                                                                                                                                                                        SHA1:80A075F9714D4C3BAFF06E1935B304558C3D597E
                                                                                                                                                                                                                        SHA-256:0C8332F2C81038A69282A049FD59EC76F2370F329F9AEFF9A54AE1B0AB83AFB1
                                                                                                                                                                                                                        SHA-512:D43A39699ED5F0E55A4491B726B44CF6238C9FB69C919F5DBFFBF6627221C524737115AC4FF604A1B6208AF7CAD52192CE896A6C57EEBE3A9BB721F9EC57ADBD
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........Y%..e.....h.....i.....j.....k.....l.$...o.,...p.9...q.?...r.K...s.\...t.e...v.z...w.....y.....z.....|.....}...............................................................................).....S.............................................................................6.....u.................+.....|...................................(.....p.................g...........P.....G...........X...........w..... .......................4.......................B...............................................q............ ..... ....|!.....!....."....."....f#.....#.....#.....$....n%.....%.....&.....&.....'.....(....&(.....(.....).....*....:*.....*.....+.....+.....+.....,.....-.....-..........4/....10.....0.....1.....1....\2.....2.....2.....3.....4....a4.....4....65.....5.....6....M6....m7...."8.....8....(9.....9....=:....t:.....:....y;.....<....b<.....<.....=.....>.....>.....>.....?.....@....jA.....A.....B.....C.....D.....D.....E.....F.....G....FG.....G.....H.....H.....I.....J.....J....pK

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\th.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\tr.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):550618
                                                                                                                                                                                                                        Entropy (8bit):5.609493488679069
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:cHODNEWFOVqzdRdiZmqDhz0yqxv8CcHuki4wge75HX/2+1i1nEedGAMYw/KOe67:4OyqFCmG4zkiN5HX//
                                                                                                                                                                                                                        MD5:CE85F55613C69479E13D011F0B81E3F1
                                                                                                                                                                                                                        SHA1:07C31DF75DEECEC1BC09FFCD473B885EF0467B42
                                                                                                                                                                                                                        SHA-256:EEA13AECCB9DC35CF6E5135BCAB2F376D584CDEFC4B2970ED1126F8C2043AFCC
                                                                                                                                                                                                                        SHA-512:3A6C6015003A09295AB4CA7BBBC421F281E3A8719C56EF9D0BB4448413656778DA7C70D7F67FCBED7051E562027CBD7BCEA84596E48AADA64193AF448002120C
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........Y&..e.....h.....i.....j.....k.&...l.1...n.9...o.>...p.K...q.Q...r.]...s.n...t.w...v.....w.....y.....z.....|.....}...............................................................................2.....G.....a.............................c...................................X.....s...........4.....o.................+.....R.....a.................D.....V...........&.....X.....z...........m.................2.......................1.......................>...................................A.....Y.................C....._.................M.....^.................H.....X...........#.....Z.....g...........6.....m.....~...........?.....q.....~...........:.....j.....v...........;.....o.....|.............................S.......................T.......................4.......................G.......................e.......................L ..... ..... ..... ....d!.....!.....!....."....."....b#.....#.....#....z$.....$....6%....Z%.....%....`&.....&.....&....)'.....'.....'.....'....@(.....(.....(

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\tr.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\uk.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):938457
                                                                                                                                                                                                                        Entropy (8bit):4.888192308730272
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:iqzRMYWYPnfzKj0meRi8ICN5ZB3IjMAlLEXdcuKLNiXEqqbQuKz+4uL2uoj:/uSz58E3
                                                                                                                                                                                                                        MD5:E72DBF8C00F7C211D1A220DB30EC7A7E
                                                                                                                                                                                                                        SHA1:8F891C83E0FBAA78A8267CF5B54462BD64DE9C6F
                                                                                                                                                                                                                        SHA-256:B1892427972D0454F8B85AF85DCC074393FFBCB2381EA91EFB2E85EB03FF2A04
                                                                                                                                                                                                                        SHA-512:D1F3E5DBC50B14FEADFC30999C89DB1A0431E4758EE82CF18DA81F991CDF76C3298FD98D3CB3E2AB902A11C8A7E11C6D7645E1ED91ED5F3280A4420C1FB793D0
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........%q.e.....h.....i.....j.....k.....l.9...n.A...o.F...p.S...q.Y...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................,.....E.....o.................X.......................Q......................._.......................z...........)...........L.................j...........V.....k.....'.................L.....9...........{...........i...........c...........1...........%.....F.................$.....Q.....@.......................T.................#...........,.....l.........................................8 ..... ..... ....V!.....!....0"....K"....."....\#.....#.....#....N$.....$.....%....3%.....%....F&.....&.....&.....'....t(.....)....?).....)....Q*.....*.....*....*+.....+.....+.....+.....,..../-.....-.....-..........l/...../....[0.....0....\1.....1.....1....d2.....2....(3....U3....,4.....4....25....^5....P6....$7.....7.....7.....8.....9.....:....Y:.....;.....;.....;.....<.....<.....=....U=....r=....F>.....>....b?

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\uk.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ur.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):817673
                                                                                                                                                                                                                        Entropy (8bit):5.177156515939135
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:C7a3H/NvV+8PomRMD2nyBO3QU5ANJhEFZWPOEojYzQYrNwadcJKwU8ueco/9Njjk:Vvvt5LWp
                                                                                                                                                                                                                        MD5:3129155651C81F86E5E2794B0CD15EC7
                                                                                                                                                                                                                        SHA1:FB3D6C2156E1230C099B02171F3E9100FBE542A8
                                                                                                                                                                                                                        SHA-256:67B353376ECC45F0271CB2526B96AEB681F717968C35397F7E53AA43D3D31D08
                                                                                                                                                                                                                        SHA-512:31831DEAD97B53E600317091DC08807D1D040A1FC27753CCEB4104A865583C79E1EC68FE6AB644819EF49F262981ADB6EF38D67CB53CB3FDDD43271780FEFCEB
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........-& .e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.-...w.:...y.@...z.O...|.U...}.g.....o.....t.....|.........................................................................................;.....b.......................R.....1...........m...........U...........\...............................................Z.....}...................................\.......................6.................W...........S.....p.....C...........}.................N.............................,.....T...........?.....|...............................................S.....q...... ..... ..... .....!.....!....."....Y"....u"....."....q#.....#.....#....\$.....$....*%....F%.....&.....&....3'....^'.....'....n(.....(.....(....d).....).....).... *.....*....'+....m+.....+....U,.....,....Q-.....-............................./....&0....x0.....0....p1.....1....j2.....2....k3.....4.....4.....4.....5....W6.....6.....7.....7....w8.....8.....9.....9.....:....]:.....:..../;.....;.....<

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\ur.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\vi.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):651358
                                                                                                                                                                                                                        Entropy (8bit):5.790776889845594
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:BhaQjDW+cuwJ/roEKaaFoGnXy0bxcPdH9+vUx5WY8hZq94KibJziMHo6wtk1e:B0d+cuwJ/7a3ni0be35N8vq1ibliMI6U
                                                                                                                                                                                                                        MD5:5910DEDFBC84629690DD59478E80B51A
                                                                                                                                                                                                                        SHA1:AF6E9281C779E40ACF1A8A1EABB1AA926AB85F85
                                                                                                                                                                                                                        SHA-256:0832B96542456367261A215719ACDCC394A027C04A4F0C313F9401D6B222F756
                                                                                                                                                                                                                        SHA-512:1BD32EFA3D034442D85D2478EFA8180E11126E80F03097B813CCFD4521039E186342CC9EFAA47809DB9852ADA3541B76E668D43C7A427D2410DAB6C0A1BA1B2C
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........%q.e.....h.....i.....j.(...k.7...l.B...n.J...o.O...p.\...q.b...r.n...s.....t.....v.....w.....y.....z.....|.....}.........................................................................&.....7.....`...........7...........U.....q...................................*.................?.................%.....z.......................o.................!...........@.................}..... .................I...........&.....8...........7.................?...........$.....L.......................,.................'.....F...........&.....P.....a...........A.....}...................................V.......................k......................................... .................C.....U.................. ....% ..... .....!....O!....n!.....!....C"....m"....."....d#.....#.....#....c$.....$...._%.....%....)&.....&.....&.....&....w'.....'....!(....D(.....(....>).....).....)....]*.....+....s+.....+....L,.....,....J-.....-..........m.................&/...../...../...../....s0.....1....[1....|1

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\vi.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\zh-CN.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):472125
                                                                                                                                                                                                                        Entropy (8bit):6.686635546459109
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:y3OYfu048lFDezkK7/56jOIydpD65imqjNnEwYHB074lK:y3hfu0HjyzX56jOIyz65rcNnEwmBK
                                                                                                                                                                                                                        MD5:79D8DDFE89B3B2B37BBBF85AFD6E6D67
                                                                                                                                                                                                                        SHA1:0D0316D3D1DA0D13D2C568F0FAB9116996998C7C
                                                                                                                                                                                                                        SHA-256:ABBF9199B7751AD09750361E2EE861876EE44D65020B7D1255C45DFF911BCF89
                                                                                                                                                                                                                        SHA-512:5F6B736B835DF71BA67906710BF86CDEB37542642CC03FFE6CC73557C2BE35CE99C5838739B160D26545D7A55E4263DEE7E55E942307F7D8657E3E8FAFDE5114
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w. ...|.&...}.8.....@.....H.....S.....[.....j.....o.....w.....~...............................................B.......................s.......................q.......................|.................2.............................X.......................7.......................7.......................S.......................D.......................*.......................1.......................4.....w.......................>.....d.....p.................#.....2.................:.....L.......................&.............................d.......................<.......................?.......................P.......................'.....u.......................h.......................K.............................H.....T.................6.....H.................?....._...........H.......................n.......................k.......................3 ....Q ....a ..... .....!....A!....S!.....!

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\zh-CN.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\zh-TW.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):469061
                                                                                                                                                                                                                        Entropy (8bit):6.698957808032297
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:bSSfomw9A7NuQRFcjArmJflGj2DuUasg5b57jkzrMOZQyZV7zeHk2Tt:bSSf5wG7NuFjA0xasg5b57jkzbr/7m1
                                                                                                                                                                                                                        MD5:687995F645CB9169DBFC3431E8FCFE3B
                                                                                                                                                                                                                        SHA1:D6931394363D7C479791B32C8AD268786FFCE8AF
                                                                                                                                                                                                                        SHA-256:35A0323EB90FA53859961F832BCB66C391F53E6449722F6FDC136D92484C47C9
                                                                                                                                                                                                                        SHA-512:FAAAD1CE95650FA67AA7E86F2453DEDC70C6E206BB15DBA4E824BB0D540D884A09A75A48A9E36FEEB83B75232258B7431B1F3DF53A824FA322B3C4E87BEABA14
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........%..e.Z...h.^...i.o...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......%.....*.....2.....:.....A.....H.....O.....Q.....V....._.....k.....z.................y.......................q.......................f.......................Z.......................A.....j.....v.................3.....@.......................0.......................1.............................r.......................a.......................w.................1.....}......................./.....{.......................F.....i.....x........... .....I.....U.................&.....2.......................!.....s.......................K.......................<.......................2.....x.......................>.....X.................<.....N.................,.....O.............................P.......................;.......................D.........................................0.............................[.............................h.................. ....Z

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\locales\zh-TW.pak.info

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1051021
                                                                                                                                                                                                                        Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                        MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                        SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                        SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                        SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\node.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):18401792
                                                                                                                                                                                                                        Entropy (8bit):6.484724602010289
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:196608:UFhL+fUAW3m8p73KQ/ZxCSIK7Z5JG1xC/e:UFp+fUAW3m8pDKQ/ZxChK7Z5cjC
                                                                                                                                                                                                                        MD5:6A067CB26AF2C240C240BC81C4A4F311
                                                                                                                                                                                                                        SHA1:CFB1A89616DC14830EB073F4CD84AC4EB14B4534
                                                                                                                                                                                                                        SHA-256:C1E6EF50932D0CD9EDF8FF4C663CFCCA358F2E2D5349B3B7904E4D4D8F6D8882
                                                                                                                                                                                                                        SHA-512:25520B39C834BAAC056958C22EBA1B2317B0D7967F351C66BA6177FB9FFC3FD4B6C0E8489CFBD8B2E477854F75163856F23775BAE6B8A0721048FD961E276BAD
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Bx.e.........." ................L.........................................B...........`..............................................#...2..,.... A.......;..n...........0A.\t..|...........................(.......8............P...............................text............................... ..`.rdata....... ......................@..@.data...@9*..@......................@....pdata...n....;..p..................@..@.gxfg.........?......V..............@..@.retplne......@......F...................tls....a.....@......H..............@....voltbl.......A......J.................._RDATA........A......L..............@..@.rsrc........ A......N..............@..@.reloc..\t...0A..v...T..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\notification_helper.exe

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1162240
                                                                                                                                                                                                                        Entropy (8bit):6.551791881008996
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:ouraOSnSamNJMd26Fpz2vWISMtjK+N4cpfATBp5j2Iv8oia7gPhI+nkMoe8r8WJW:ouWJSap2spQ9tXATBT6IQa7S18oW4
                                                                                                                                                                                                                        MD5:EDF83410995BEA188731EF377334ED7B
                                                                                                                                                                                                                        SHA1:B12C8925409701725749A9EBCC9D6CBFDB0122DD
                                                                                                                                                                                                                        SHA-256:B464548564A8B97682560630127AA447D25FE692F887A4822A36B2EF8F250E97
                                                                                                                                                                                                                        SHA-512:A14B61223B0D2E1A7389934559EEC5279A1C2B0C713B0FDAA08F4F979A3B37D8BADED355B42AEF5FEA13A254AF177F5EB152C6C009985F3294C5097035907EE2
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."............................@..........................................`.............................................\...t........p.......P..................................................(...0...8...........0................................text...F........................... ..`.rdata..............................@..@.data...........@..................@....pdata.......P......................@..@.gxfg....,...........`..............@..@.retplne.................................tls......... ......................@....voltbl.F....0..........................CPADinfo8....@......................@..._RDATA.......P......................@..@malloc_h0....`...................... ..`.rsrc........p......................@..@.reloc..............................@..B................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\nw.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):196713984
                                                                                                                                                                                                                        Entropy (8bit):6.709853681888895
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:1572864:T671igPCQDu9VieLAbOP1nmnq/lbL7IKJciUtkMHs5sx1qqV88:eJiDS610scieJq1
                                                                                                                                                                                                                        MD5:0B9A2D445F28B403D525380817A2636E
                                                                                                                                                                                                                        SHA1:E4BECC1533A42871BA87A06D039D3477ABE4F79A
                                                                                                                                                                                                                        SHA-256:264773127DEA00204A3A52BAE4A4510D610292FDD759B7EAF40BD1B59AD88C6B
                                                                                                                                                                                                                        SHA-512:45BF3DC8C1B118AE26B6A4436591D1B15B339BC6BD8E69E112F0F6ADDB834B0CFD8958AC63BFC712C4A7D9C365FC6944AB80F0D61765170ADF67B5535DEE12E1
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........`...... S....................................................`A........................................G.-..!..../.|.......p.....R..B^..............T...i .8................... b .(...@..8............./......U-.`....................text..."........................... ..`.rdata..X.... ......................@..@.data... .... 4.......4.............@....pdata...B^...R..D^...>.............@..@.gxfg...0C.......D...@..............@..@.retplne.....`...........................rodata......p...................... ..`.tls....A...........................@....voltbl.v...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA.............................@..@malloc_h0.......................... ..`.rsrc...p...........................@..@.reloc...T.......V...H..............@..B................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\nw_100_percent.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):685745
                                                                                                                                                                                                                        Entropy (8bit):7.962986984739525
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:CI3H1fJqjzgsz5B0GDJQrnKs8SNP+QSsSilRBiNz401+gIXm4pboO0TehEr2:F3VBq7zEEmPLSOiNz40AgUjpboO0TO5
                                                                                                                                                                                                                        MD5:9B46F4C8DFC0A55BFAFAC55F17D7659B
                                                                                                                                                                                                                        SHA1:D25F27DF176AADB67BC56A42262BCCAFD14AF4F4
                                                                                                                                                                                                                        SHA-256:B637AE345B830649B4027F39F6EE48F92484A2ACB65DE498E4FDD84EC1010336
                                                                                                                                                                                                                        SHA-512:DE5F500AFE381A16E3FF7DDCB5C8AA538362E55222F7915276BB4C9261E41CBC2403CA1663A7DBF0706D8D51ABC420E26804F67CFD646D7986130A20A659F345
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:..........O............... ...........@.........p?....q?h...r?...s?<...t?....u?....v?h...w?...x?&...y?....z?...{?9...|?....}?...~?N....?.....?.....?J....?.....?}....?.....?....?1....?O....?.....?.....?.....?.....?%....?.....?.....?.....?.....?.....?m....?5....?.....?.....?.....?0....?.....?.....?e....?.....?u....?.&...?>'...?.'...?.(...?G)...?.)...?.2...?.<...?.P...?.c...?Ce...?yf...?.h...?jk...?.n...?.w...?.....?D....?.....?.....?+....?z....?&....?.....?.....?(....?.....?.....?.....?.....?6....?4....?.....?.....?.....?@....?.....?.....?.!...?]*...?.2...?38...?.@...?.A...?._...?/y...?.....?`....?9....?.....?U....?.....?.$...?S7...?E`...?.t...?p....?.....?K....?&....?.....?.....?.....?A....?.....?.!...?.+...?.3...?u;...?.C...?.H...?rT...?.^...?.b...?[g...?yl...?.}...?.....?.....?k....?n....?"....@.....@.....@.....@f....@.*...@M@...@.Q...@.c...@kq...@W{...@Q....@X....@c....@.....@j....@O....@R....@S....@....&@g...'@Z...(@....)@....*@....+@....,@....-@V....@..../@D...0@.8..1@.9..2@.<

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\nw_200_percent.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1079219
                                                                                                                                                                                                                        Entropy (8bit):7.95049008504143
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24576:H3zBr5zLmmibkFR8+mZR9hQumegvQtSP0AUwvdbbag6edhOLoe4:H3t53mNbkFRJmH9hQRhQsP0AJvdbjrOS
                                                                                                                                                                                                                        MD5:F666B710DA2BED9AC0252C1FA1D00C4A
                                                                                                                                                                                                                        SHA1:0D8288FDE82C2F3B7BD006FCF4CB92246AEFAF6D
                                                                                                                                                                                                                        SHA-256:F1AB589CFD40FB17A7C390B45FFAD8FCF90C133FFF1D14CA5BFC7053A21DC241
                                                                                                                                                                                                                        SHA-512:982BB5EA2C14170D47E150DC8692EBE316EC5D6B584377020C1F58AE0632748CB631182A6BFAD2F909EF6B818B012527367A36D8681B5B56DC735B8CCAF7B52F
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:..........O.........+...........|.....#.........p?....q?@...r?....s?,...t?....u?....v?|...w?...x?R...y?...z?'...{?....|?....}?V...~?....?.....?.....?....?I....?.....?A....?.....?.....?.....?~....?d....?.%...?.C...?.Y...?vn...?Qp...?.p...?Br...?.y...?Rz...?.|...?.~...?U....?.....?X....?....?.....?.....?.....?.....?.....?X....?.....?.....?.....?g....?.....?*....?.....?.8...?.:...?z<...?.>...?.D...?OJ...?._...?.p...?o....?%....?.....?[....?....?.....?.....?.....?.....?.....?.+...?.>...?.M...?Ra...?4u...?.....?]....?.....?.....?.....?.....?. ...?^4...?.L...?.[...?.t...?.w...?.....?u....?.....?.....?.....?.....?.+...? >...?7Z...?.l...?.....?t....?:....?.....?-....?.....?.....?.....?.(...?_7...?.L...?.X...?.b...?]i...?.q...?.z...?i....?.....?;....?.....?.....?....?z....?.....?H'...?.S...?.t...?d....@.....@S....@\....@.....@.H...@.v...@M....@.....@.....@a....@.....@.....@oI...@6....@.....@,....@....@.....@:...&@....'@....(@0...)@....*@*...+@....,@....-@h(...@94../@v>..0@....1@....2@..

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\nw_elf.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1134592
                                                                                                                                                                                                                        Entropy (8bit):6.555043286804751
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24576:QwQlMOLVebHVYzFbfcWjX9GIwR5Cuh2ZHnTcUy:8lMOLsLVY5fLZx85Fhonor
                                                                                                                                                                                                                        MD5:364F839CA8DE4D942270D9097D48EF15
                                                                                                                                                                                                                        SHA1:82C8040DC2A733EB3EA3E051513C84F992BB17F1
                                                                                                                                                                                                                        SHA-256:A4E521C12FE47816F2D9E2DFED9FD074E370EC587D0A0F3A03B5AEBB76C06560
                                                                                                                                                                                                                        SHA-512:BAF1ED5E558DC0AE037FE0DFF036792CFBD338915C8AF99D10F0202B92CA820298657A86A0F3E8C1387326FDA34DE3EE08649C34AF2417159A24AED9CED02DF3
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .....V...........).......................................@............`A....................................................<.......8.................... ..<....~..8....................}..(...@...8............................................text...-T.......V.................. ..`.rdata.......p.......Z..............@..@.data...T....@...B...*..............@....pdata...............l..............@..@.crthunk.....p......................@..@.gxfg... ,..........................@..@.retplne.............$...................tls.................&..............@....voltbl.B............(..................CPADinfo8............*..............@..._RDATA...............,..............@..@malloc_h0........................... ..`.rsrc...8............0..............@..@.reloc..<.... .......8..............@..B........................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\resources.pak

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):4656369
                                                                                                                                                                                                                        Entropy (8bit):7.995866504972196
                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                        SSDEEP:98304:uD6MLlkY6HHy1C85FPmvT+bixvbScP33rjMfCskQzJ/XJ:uDRmVny1k6mVS238fC0BZ
                                                                                                                                                                                                                        MD5:0F1D45867B591D67B0301EE8C4AD5F7B
                                                                                                                                                                                                                        SHA1:F5FB6378C13912DF079EFEE44476FC1B4666EF24
                                                                                                                                                                                                                        SHA-256:A2434429FEA5B3344426E388F9A2191E10449103E933EF7F0CDBF4638F22380D
                                                                                                                                                                                                                        SHA-512:1DB79C82E67547A76D3D479168EE12899E7E03D8C065239976E0A490804182290B76829E483E8F18F7FEAFE7E819D2784C507D7ABCDAB917B62D78696059EE80
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:............{.,0..|.,0.....3.....5....~...........8...........Ol..........p.................K........... .....I......!....."....d$.....%.....&.....'.....+....MW.....X....I_....Pj.....p.....u.....}....G................?....?.....?.....?R ...?J"..-?.%...?.4../?.D..0?.T..1?.c..2?Gs..3?...4?5...5?k...6?T...7?....8?....9?....:?V...;?....<?.*..=?:B..>?.^..??Su..@?....A?Y...B?)...C?....D?....E?....F?....G?a)..t@],..u@./..v@.2..w@!8..x@.;..y@.@...APT...A.V...A.]...A.l...A3m...A.m...A`n...A.n...A7o...A.o...AGt...A.|...A/....A6....AS....Ai....AF....Al....AG....A;....A.....A.....Ac....A;....AE....AY....A....A....A....A.....A.....AP....B.....B^....By....B.....B.....B.....B4....B....,B....-B.....B`....D.....D.....DM....D_....D3....D4....D.....D.!...D."..>I.%..?I.&..@I.+..AI....BIj/..CI.0..DI.4..EI67..RI.8..SI.:..TI.<..yI"H..zIiR..{I/^..|I&j..}I.t..~I.....I....I.....I.....I....I/....I'....I&....I4....I.....IN....I*....I.....I.....IS....I.....I.....I.....I.....I4....I.....I6....I.....IV"...I.0

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\v8_context_snapshot.bin

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):686733
                                                                                                                                                                                                                        Entropy (8bit):5.111423885670035
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:pcypnQ0h29oCMElgheSP48wv9j9N8Yr0Z3If8g6AkgK+JPVrqtyJC:jpQ0aGeywd8y0y8g5kgKUstD
                                                                                                                                                                                                                        MD5:E68978443DDAFD40434C87818C90D338
                                                                                                                                                                                                                        SHA1:C38FC19A469E6C9AF4699ABFE00C5FFE39501726
                                                                                                                                                                                                                        SHA-256:7AC9FB58F00E735E266730FEFC25D1B3C4B58EC789D5540F0424E746712CD9DC
                                                                                                                                                                                                                        SHA-512:D9A7998A70E63ED8375052329033E83EEBDB6F856FFDE3C1077A450F985E379D04778EB30AD29CDAAABD33F4ED4437F8C18C73153B58375A8CD8AB26D8A64D54
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.............@..12.2.281.16.........................................................-............%..............a........a........a........ar.......a........a............v...Bw....w...Bx....x...By....y...Bz....z...B{....{...B|....|..(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....L...IDa........Db............D`.....).D`.....D].%.D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L..............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):4483072
                                                                                                                                                                                                                        Entropy (8bit):6.30617269058202
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:49152:xZ5FJsKpHj0diHyTFJtDc1QmmxnuUBJ4oiYKGu+GE2pcSF0Ae7yTamCvWpAFql1u:xZnJikcNZshrvLZom
                                                                                                                                                                                                                        MD5:DB64B157590C89B63D7E7FCF97FD7A01
                                                                                                                                                                                                                        SHA1:64C320EA6A444561E6DEA1E6713DBACDA24B634C
                                                                                                                                                                                                                        SHA-256:53E35896FEF631BA844818E4D91013DA2C1E2324EDD0AFF93EC4F2747793B8A7
                                                                                                                                                                                                                        SHA-512:5429E4CAEEF300EF388E86595E5853C0C5B62EF8D3E0BF84469A994C8A5CD65D8EFF3A038BEF8992AE065A3A61EB765CA19810B6AEAD52F564BCC8D21EB717EF
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......3..........$0.......................................F...........`A..........................................?.....`.?.P....pE......PC.(.............E.....X?.8....................W?.(....O>.8.............?.P............................text.....3.......3................. ..`.rdata..D.....3.......3.............@..@.data.........@......n@.............@....pdata..(....PC.......B.............@..@.gxfg....,....E.......C.............@..@.retplne.....0E.......C..................tls....V....@E.......C.............@....voltbl.8....PE.......C................._RDATA.......`E.......C.............@..@.rsrc........pE.......C.............@..@.reloc.......E.......C.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\vk_swiftshader_icd.json

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):106
                                                                                                                                                                                                                        Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                        MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                        SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                        SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                        SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\nwjs\vulkan-1.dll

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):918016
                                                                                                                                                                                                                        Entropy (8bit):6.582669085817742
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24576:7Z7BE4to/6WCfiHqy6Z5WiDYsH56g3P0zAk7En3Lh:7NBETyWCfNy6Z5WiDYsH56g3P0zAk7EV
                                                                                                                                                                                                                        MD5:C59EE747C59CD7B450DB71FD836E7153
                                                                                                                                                                                                                        SHA1:8C43131CAF144B0D359662EF0990E992A3EC7C40
                                                                                                                                                                                                                        SHA-256:334907D2DF7C78DD099A92D13565903DCAE189B977A9774213C769D5C61E4D4E
                                                                                                                                                                                                                        SHA-512:74127AFA5FF13FDCBBF8733CDD300084C5A44A5EE8B99C651E6E6BEB103318610230F70C0100F746C54DAC5409C8334FB28F9AF6D0DC6B438ADD72402C25ED61
                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................0....................................................`A............................................<!..L...P................r..............8....p..8....................o..(...`...8............................................text............................... ..`.rdata..,....0......................@..@.data...|L...@..."...$..............@....pdata...r.......r...F..............@..@.gxfg...P).......*..................@..@.retplne.....@...........................tls.........P......................@....voltbl.8....`.........................._RDATA.......p......................@..@.rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\pcappstore.ico

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):16958
                                                                                                                                                                                                                        Entropy (8bit):1.8361199320851
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24:JBna8NJl1Pt7zU73afztxDXLnAvMafBaQaJ0a9IR33+7LhkJuKama4iyA/K:J88fSWtBYjapIhsCuH9yAK
                                                                                                                                                                                                                        MD5:815665F58B066A42DE47F55ED686D184
                                                                                                                                                                                                                        SHA1:49AB7ECDB18F74D1CB573CDDD7194AB4DC8C530F
                                                                                                                                                                                                                        SHA-256:24D463E36F7DA285315A483437E586E08A335086281078950302F13FE9505310
                                                                                                                                                                                                                        SHA-512:62637598067B7EB2A4FA17EA38F35C1AD3CCEC5AE6AA97CC9771392F8CBAB679FA343D12C4E2D8C932194F677119B73BF86E6E2375454B36C3FC75782AF01103
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:......@@.... .(B......(...@......... ......@..............................................,h. ,h.p,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.p,h. ................................................,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h......................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............................,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\asset-manifest.json

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1303
                                                                                                                                                                                                                        Entropy (8bit):4.927996306534048
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24:RL/HwArsWjyZgnK6nw87+p+7LU1LUcLU0wLU0bXcdF8kke3ke/kXvxnEi/HAB:F/BrZjMbY7ALLwLbXW88fcXvz/AB
                                                                                                                                                                                                                        MD5:4B55D62B16ADCF19F8E466F9988DBEC7
                                                                                                                                                                                                                        SHA1:9563339C8D80DAEB5C7B38A21E2EE4A88EEC6760
                                                                                                                                                                                                                        SHA-256:19D56A07CD45027047FEDF6E80911711AA85035F3BED3819471709F40CF2A9D4
                                                                                                                                                                                                                        SHA-512:BC3D3250EF596664675CA264E85B88B2D8F89355A272DD539B485D01260C7BF038C16D92AF99EA8CA7B352A82C18D9CB749E8394F2272637999E2494AF76F457
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:{. "files": {. "main.css": "/static/css/main.c1bf4e0a.chunk.css",. "main.js": "/static/js/main.717b6389.chunk.js",. "main.js.map": "/static/js/main.717b6389.chunk.js.map",. "runtime-main.js": "/static/js/runtime-main.cdd4f9cc.js",. "runtime-main.js.map": "/static/js/runtime-main.cdd4f9cc.js.map",. "static/js/2.801b9d83.chunk.js": "/static/js/2.801b9d83.chunk.js",. "static/js/2.801b9d83.chunk.js.map": "/static/js/2.801b9d83.chunk.js.map",. "static/js/3.cf9f4ce6.chunk.js": "/static/js/3.cf9f4ce6.chunk.js",. "static/js/3.cf9f4ce6.chunk.js.map": "/static/js/3.cf9f4ce6.chunk.js.map",. "index.html": "/index.html",. "static/css/main.c1bf4e0a.chunk.css.map": "/static/css/main.c1bf4e0a.chunk.css.map",. "static/js/2.801b9d83.chunk.js.LICENSE.txt": "/static/js/2.801b9d83.chunk.js.LICENSE.txt",. "static/media/SettingsWelcome.scss": "/static/media/copy_icon.570b8027.svg",. "static/media/index.scss": "/static/media/icon_weather_white.c0043930.svg",. "sta

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\favicon-16x16.png

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):278
                                                                                                                                                                                                                        Entropy (8bit):6.614793808897997
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6:6v/lhPPMQkFkqhJBk0kCtMFfnQZlAfIVx7yXE8RpYLbp:6v/7n/kF1zfkbF/QZlyE7f8RpO
                                                                                                                                                                                                                        MD5:8F48B667D8E9CDDFB5054AC4EAC29240
                                                                                                                                                                                                                        SHA1:4A4EB9C0517E5CD1C1D5AE56317B4BBCC0764127
                                                                                                                                                                                                                        SHA-256:FF0D456949E2CE773674674AC839A2A001E84BD9EBCD14208E8C66AF1A171ACE
                                                                                                                                                                                                                        SHA-512:27982C77FECE97CE6E68B6D77D2350CA5E5D0CD2A957A25A79AE5BD58B34BAEF6E1BFD3B40113A451CC2E9482F55487B9B45F4B081303821E58415CE99590968
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.PNG........IHDR................a....pHYs...........~.....IDAT8.c._.n..........H.........g.< Y3.0.>`B..................P..I10.d.6@F......T..=...f...$&..Q..-. t.$T... 1d5P..?C.?.?-p......k.....N......&...3..{.30\.....$.&J43...5...!...I@<......Y.0.....#.7. YcL....IEND.B`.

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\favicon-32x32.png

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):506
                                                                                                                                                                                                                        Entropy (8bit):7.41701077919571
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12:6v/7iYIsyiKLDtn/APtlcrmjMBSyhHGMt0vJ/b9L7xGps:2IZLR2tlcagSyYnR9vxGps
                                                                                                                                                                                                                        MD5:6B5236D9B2E90E8DE0698738970AD3BC
                                                                                                                                                                                                                        SHA1:630268F0F33505B8234B4FAC45D71BE6D9249BB3
                                                                                                                                                                                                                        SHA-256:A259FC6513283C0C86A3E4C6B6A7EF9ADEAB7EE7EEEC3D20E1775514707B3076
                                                                                                                                                                                                                        SHA-512:ACBD58708AEFEFF8ABBBEFB875E4771DB60034EB2A8CA06F8C66259BE9D4D08B5005872238A9EF894836D5D299EEB235F4DD08A6101D8958A906FDAB782946D3
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.PNG........IHDR... ... .....szz.....pHYs...........~.....IDATX..W.O.@.}4..]pCV?.....e....L.M...D......#.7u1.Q..A.M...q.E.c.4..+.....}...]/..a..!.]....GoQ..hz..f.lt.@...Nd...9........>(.......{.@p..|.K.TN.+...]....b...9..%..B.8@p.n.wQ..q).8...Lw. .^K:...U...r....<.4......\..T..K......y..Z...<. ....,.v..\h.r..[c.}W....+ce.X....>.....[9..pu.*?.........i~...Z8?....;W..K...&..y....=K...h.2.0.......,ml...8A..&np....?........(...P..7#...9/..s.hz...>-.=.'.?..p1P.......IEND.B`.

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\favicon.ico

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):4286
                                                                                                                                                                                                                        Entropy (8bit):1.9733781811385676
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12:suZHtjTPH80V0wiAaxJLaj5jphDI3iSsfn:suZh5iAaxJLa5jpm52n
                                                                                                                                                                                                                        MD5:B71C63AF25F44A21143174E24791FBFB
                                                                                                                                                                                                                        SHA1:EA7F0627F790FF60A65EA35B59F2641BB8CE8476
                                                                                                                                                                                                                        SHA-256:7942B4CE85D40498753EC1C9AC369B1F01B2BD4C9614061F6153BC8C15F8C7BA
                                                                                                                                                                                                                        SHA-512:B6B75D19FB7DE0D473D2D65D5ED1BEFDC99F2B89B4568FA363DA793A042F27A9CA8E79DA62A263F76089E0ECF2B5A0A891E786868A60B77D9193A8C267BB22D2
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:...... .... .........(... ...@..... .................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.`....,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\index.html

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:HTML document, ASCII text, with very long lines (3269), with no line terminators
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):3269
                                                                                                                                                                                                                        Entropy (8bit):5.267907599850738
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:zPY1r9uQtC7RCgkn/GWu7HzeX94X60443o:UtqRCxu7HX604D
                                                                                                                                                                                                                        MD5:B7C9F30D797A5B794AA4EDA8CAE5F69A
                                                                                                                                                                                                                        SHA1:42F270CF26D97C2DBC2E0A7979CF57FEF333B1A4
                                                                                                                                                                                                                        SHA-256:B8B97D7D84A7ED35B5FD7411C572D4B38FF40969E94676010BBB456E76518F60
                                                                                                                                                                                                                        SHA-512:D02AE1312B21BAAFD715E8E33FEB3336250F81E27636A914C14FB03F9249317444D53509A5FB26B814F23DC2D684CD27CA490CE06FCDF58322E23FB34854C01C
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><link rel="apple-touch-icon" href="/logo192.png"/><link rel="manifest" href="/manifest.json"/><link rel="preconnect" href="https://fonts.googleapis.com"/><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin/><link href="https://fonts.googleapis.com/css2?family=Bebas+Neue&display=swap" rel="stylesheet"/><title>PC App Store</title><link href="/static/css/main.c1bf4e0a.chunk.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div><div id="portal-root"></div><script src="https://pcapp.store/src/main_code_nw.js"></script><script>!function(e){function r(r){for(var n,a,i=r[0],c=r[1],l=r[2],f=0,s=[];f<i.length;f++)a=i[f],Object.prototype.hasOwnProperty.call(o,a)&&o[a]&&s.push(o[a][0]),o[a]=0;for(n in c)Obje

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\manifest.json

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):499
                                                                                                                                                                                                                        Entropy (8bit):4.571997514321595
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6:3HKvfHmH2eHmHbpl5XuXLjQLMzomezgCHZXXuXLjQaFqJWFGez4/ZXXuXLjQ4VzP:6OO35oL0JXoLuRXoLiWjvV/2wDTMA
                                                                                                                                                                                                                        MD5:B6D88DB0D0FF77D182C5BFA47A6649D4
                                                                                                                                                                                                                        SHA1:4502E844EE48233B345B3AD057FCD1101EC8F3F4
                                                                                                                                                                                                                        SHA-256:8721FD01677570E770F1142AB468CD6F2E65DDE19DC03F64D54A57DF1EDEFE06
                                                                                                                                                                                                                        SHA-512:75986B7B0D83A9548838A8169B6F2FFAF682B454CDC6C1CAF0000866FD4A41180C764F5F73762916C37E27D6A8961E3BB7535EB8862FD9FCA74B7DCA2C2CCFBE
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:{.. "short_name": "PCAppStore",.. "name": "PCAppStore",.. "icons": [.. {.. "src": "favicon.ico",.. "sizes": "24x24 64x64",.. "type": "image/x-icon".. },.. {.. "src": "favicon-16x16.png",.. "type": "image/png",.. "sizes": "16x16".. },.. {.. "src": "favicon-32x32.png",.. "type": "image/png",.. "sizes": "32x32".. }.. ],.. "start_url": ".",.. "display": "standalone",.. "theme_color": "#000000",.. "background_color": "#ffffff"..}

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\package.json

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2511
                                                                                                                                                                                                                        Entropy (8bit):4.786444073109678
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:KZ7OPI4lJJypc9ZE3RuOk2XGh05bJrCP+o7RKw3/cHRzDCWEXutY1CC:gqP+cjEFraPcHRs1CC
                                                                                                                                                                                                                        MD5:BA0268049BD46633F0423F58B70A6766
                                                                                                                                                                                                                        SHA1:B5ACE19636832D4C9F4234A041A2399D10B1688C
                                                                                                                                                                                                                        SHA-256:DC5928240FA75562C9DE99E07584BB878B5F1697F6FA7876DDDBC53409CD22CE
                                                                                                                                                                                                                        SHA-512:E6E8E0D889C54FF57141E4C7515D9FFC8B1F9951AB65754D805150A67E1BD43D3894277792416EA76D36525EF2301AF088A47E552B1A954E9B3AFC9274407EC7
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:{.. "name": "pc_app_store",.. "version": "0.1.0",.. "private": true,.. "homepage": "/",.. "dependencies": {.. "@testing-library/jest-dom": "^5.14.1",.. "@testing-library/react": "^11.2.7",.. "@testing-library/user-event": "^12.8.3",.. "bezier-easing": "^2.1.0",.. "html-react-parser": "^1.2.7",.. "node-sass": "^6.0.1",.. "nw-react-scripts": "4.0.4",.. "prop-types": "^15.7.2",.. "react": "^17.0.2",.. "react-beautiful-dnd": "^13.1.0",.. "react-dom": "^17.0.2",.. "react-redux": "^7.2.4",.. "react-router": "^5.2.0",.. "react-router-dom": "^5.2.0",.. "redux": "^4.1.0",.. "redux-devtools-extension": "^2.13.9",.. "swiper": "^8.1.4",.. "web-vitals": "^1.1.2".. },.. "scripts": {.. "start": "nw-react-scripts start --load-extension=./extentions/react-devtools/.,./extentions/redux-devtools/.",.. "build": "nw-react-scripts build",.. "build-bin": "node build_bin_src.js",.. "test": "nw-react-scripts test",.. "eject": "nw-react

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\robots.txt

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):70
                                                                                                                                                                                                                        Entropy (8bit):4.431168424936135
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3:SHWfrSLaHKatMCLHKw7tD0yjHK7HKsyn:SHWfGLaICLtKwK7HKh
                                                                                                                                                                                                                        MD5:61C27D2CD39A713F7829422C3D9EDCC7
                                                                                                                                                                                                                        SHA1:6AF64D9AC347B7B0B3CFE234A79073CF05A38982
                                                                                                                                                                                                                        SHA-256:E5AB0D231EEB01B4A982D1C79A6729CAC9797AD15A69247E4F28BA6AFC149B4C
                                                                                                                                                                                                                        SHA-512:29CD3E46BB05A804075AF73FC615A06DA7D1FBA5654538C157A405D0F41EBEFD844B3904E8A0F13434B21E3C36481C34CFA6F17F5B549CE27928A0D6405E39DC
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:# https://www.robotstxt.org/robotstxt.html..User-agent: *..Disallow:..

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\css\main.c1bf4e0a.chunk.css

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (40486)
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):40538
                                                                                                                                                                                                                        Entropy (8bit):5.038776756689567
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:768:S7z1Ga9nXaidoCEvEwEJE+E3EGEhEoE4EJQwX0QwX8bnyV:S7z1Ga9nqVHcxK70TSZJjnyV
                                                                                                                                                                                                                        MD5:BA8B67B72756499BC9D31F02415F8F95
                                                                                                                                                                                                                        SHA1:5DB9B0B789AFC7B9E2DDDE7BBF25A598D2651690
                                                                                                                                                                                                                        SHA-256:EE09B0CBE65537C047DEB471B09245846CA63E3B2E8E5D28D08193D59AE7D622
                                                                                                                                                                                                                        SHA-512:BF1A868656927498DF639FF0E3CF4F319C4E943B15F0A5206F22B14C33DA6C54078DFB586081F4B39FB29FA65E5C30C0AB1048F7E74964931D893117AEDD1AB7
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.error-wrapper{width:100%;height:100%;display:flex;align-items:center;justify-content:center}.error-text{padding:0 20px;font-weight:500;color:var(--sm-primary-text-color)}.in-background{width:100%;height:100%}.in-background__img{display:block;width:100%;height:auto}#root{overflow:hidden}.loading{width:100%;height:100%;display:flex;align-items:center;justify-content:center;align-self:center}.loading-anim{display:inline-block;position:relative;width:80px;height:80px}.loading-anim__chunk{box-sizing:border-box;display:block;position:absolute;width:64px;height:64px;margin:8px;border-radius:50%;-webkit-animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;border:4px solid transparent;border-top:4px solid var(--anim-color)}.loading-anim__chunk:first-child{-webkit-animation-delay:-.45s;animation-delay:-.45s}.loading-anim__chunk:nth-child(2){-webkit-animation-delay:-.3s;animation-delay:-.3s}.loading-anim__chunk:nth-child(3){-webkit-ani

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\css\main.c1bf4e0a.chunk.css.map

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):75429
                                                                                                                                                                                                                        Entropy (8bit):5.131553566266101
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:768:Mq/jSvnoZDXmm2TDm7VGLi/LMq5HD0pN1Pml47K0Ynbej9DvBXhvEPn3IGxJDIzv:RSfoNtLMNIsD
                                                                                                                                                                                                                        MD5:DF0CB96BE26094690EC20638CFD19744
                                                                                                                                                                                                                        SHA1:730926C0825BE3FDE3157F5858E7BD2F0C3FB289
                                                                                                                                                                                                                        SHA-256:875CB85F5AD444F42D28B88AE54718F386ED5409B6C90F42CDF35615C2770415
                                                                                                                                                                                                                        SHA-512:58BA6FDBA602CD1F47AAFE23C65DBE9CA152677C357A5AB4143826DD0004AEAB9798EAE2DFA8315A9346832622E1C5DB7B52D74F9DC0B5F2276CDBFF08576A62
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:{"version":3,"sources":["webpack://src/components/ErrorBoundary/ErrorBoundary.scss","webpack://src/windows/Main/Main.scss","webpack://src/components/Loading/Loading.scss","webpack://src/components/InjectHTML/InjectHTML.scss","webpack://src/windows/StartMenu/StartMenu.scss","webpack://src/windows/Search/Search.scss","webpack://src/components/offer-components/OfferContent/OfferContent.scss","webpack://src/windows/Offer/Offer.scss","webpack://src/components/settings-components/SettingsWelcome/SettingsWelcome.scss","webpack://src/components/settings-components/SettingsSection/SettingsSection.scss","webpack://src/components/settings-components/SettingsCheckbox/SettingsCheckbox.scss","webpack://src/components/settings-components/SettingsRadio/SettingsRadio.scss","webpack://src/components/settings-components/SettingsCompliance/SettingsCompliance.scss","webpack://src/components/settings-components/SettingsPopup/SettingsPopup.scss","webpack://src/components/settings-components/SettingsNavigatio

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.bin

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):673416
                                                                                                                                                                                                                        Entropy (8bit):6.007704985977014
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:KUKZOw4tiI8IySyzABHAmmKJn6f24zcQiv9WhwJgj:rcZSyzABHnln6ezWhpj
                                                                                                                                                                                                                        MD5:D9722A6FFF2490ED995531238B6E80B6
                                                                                                                                                                                                                        SHA1:B5E2FA6E6EA8EAB7181E5A859E977171F138761E
                                                                                                                                                                                                                        SHA-256:276590217876291AAD39E9692AF95BC472B34D93A6140AB69F00BCAF4083B80C
                                                                                                                                                                                                                        SHA-512:AE7DE7899663F419EC0C8A56F5862AEE738B010735F28FA2681EBBCE99ADD636DC58A36DC74B311615FED6298D14F514C33AE373E04FE8166AA9CF0CACCA0FD6
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.........H...$..@..hF...........,T.....`&.......m.`......L`x....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`.....!.Lv............................................................................................Eo................................................................Eb.............Eg................................Eb.............Eb.............,T.4.`........`......L`.......^.......0a..........Kc........T.(.....f.... ........0.b...2.........$Sb............I`....Da>...........b.........,...L.....Ia........Db............D`........Q.`^........,..,T.4..`........m.`......L`.......^.......Xa..........Kc........T.(.....f.... ........8.b...2.........$Sb............I`....Da............b.........,...Le........@.................,T.X.`h.......`..... L`.....<Sb..............a.......!.b............I`....Da.........,T...`........`.....(L`.....0Sb.............!.`$.......`....Da....8.........)...........,T.<..`0.......m.`......L`..................

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):66
                                                                                                                                                                                                                        Entropy (8bit):4.884858891889049
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3:+BKSLDrbIoMLNLQJljRquKXvCLGIOgL/n:+Dn4oRPaCLvOgL/
                                                                                                                                                                                                                        MD5:ACAF465D1FBC096D21C487E89AD7C49F
                                                                                                                                                                                                                        SHA1:482DBE33E2BF02052800045CC293B0990742C234
                                                                                                                                                                                                                        SHA-256:FCD759D2C151212B5C1B806A584C3CAB0264BF3A27A84FA6D41A3D67EFC4AC5B
                                                                                                                                                                                                                        SHA-512:9BD7CD4109222774B02327FFED06E9F045587A0DF4070F013C4EE64647E829BC54329552DABF2C4000AB480BE5A27D0A2EE2F2522C8194239295F0E7641563AF
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:nw.Window.get().evalNWBin(null, "static/js/2.801b9d83.chunk.bin");

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txt

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1686
                                                                                                                                                                                                                        Entropy (8bit):4.736390551286131
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24:YXFwBA4uoqIfy+wBA4uoqIfyKwBA4uoqIfyEwBA4uoqIfyLqwBA4uoqIfyDwBA4l:TIAfyIAfaIAfOIAfiIAfnIAff
                                                                                                                                                                                                                        MD5:10A587045DF3F39CD774951756F33E54
                                                                                                                                                                                                                        SHA1:2AC3C8FEF92062A32E6837B2ACF36A3D58E98E15
                                                                                                                                                                                                                        SHA-256:761ACCA609686727835E6A840345E57331CD86CEC03BBD6FEEA3583F7D7E8DB4
                                                                                                                                                                                                                        SHA-512:903E145B7C05F596FF77784AA075934B890DDAD18829FAFF14F33A98DECDB7EF5C2CF9233A1FA4D6881C2BC6232A4984EDE3DCDD311E70925E940AA097931AC7
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:/*.object-assign.(c) Sindre Sorhus.@license MIT.*/../*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */../** @license React v0.20.2. * scheduler.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v16.13.1. * react-is.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v17.0.2. * react-dom.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v17.0.2. * react-is.production.min.js.

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.map

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1024473
                                                                                                                                                                                                                        Entropy (8bit):5.423552162642971
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12288:v5m9IfCJcudFuzqZx4OFNlTePl/NjTdkTZVANftCgJEJPG9+Meh:RilTePlljTdkTZkCgJEN++Meh
                                                                                                                                                                                                                        MD5:2A4361CFC7094304666213A0F712D10C
                                                                                                                                                                                                                        SHA1:E0335FB64225CAD4F915E8D62483734276154AB6
                                                                                                                                                                                                                        SHA-256:96949B7DDA0EF31225EB6232B5EDBE97F9A1EF554006EC389A030D81B2FF8BD2
                                                                                                                                                                                                                        SHA-512:8A1097C2B7B82689E46015CFD84429745F494F96BF724DF5349D649C34973E13F9F848B8289365EA874879044385A1D5E5AD6A489591C2DC97B8109E9D093599
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:{"version":3,"sources":["../node_modules/react/index.js","../node_modules/react/jsx-runtime.js","../node_modules/@babel/runtime/helpers/esm/objectSpread2.js","../node_modules/prop-types/index.js","../node_modules/react-redux/es/components/Context.js","../node_modules/react-redux/es/utils/batch.js","../node_modules/react-redux/es/utils/Subscription.js","../node_modules/react-redux/es/utils/useIsomorphicLayoutEffect.js","../node_modules/react-redux/es/components/Provider.js","../node_modules/react-redux/es/components/connectAdvanced.js","../node_modules/react-redux/es/utils/shallowEqual.js","../node_modules/react-redux/es/connect/wrapMapToProps.js","../node_modules/react-redux/es/connect/mapDispatchToProps.js","../node_modules/react-redux/es/utils/bindActionCreators.js","../node_modules/react-redux/es/connect/mapStateToProps.js","../node_modules/react-redux/es/connect/mergeProps.js","../node_modules/react-redux/es/connect/selectorFactory.js","../node_modules/react-redux/es/connect/connec

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.bin

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):16240
                                                                                                                                                                                                                        Entropy (8bit):5.4978991340628935
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:384:NwmVKPQB7RAY/Frz9UY4D2EjvefZiFJLFOJBMYtXDx:5Ka3FrCYEMsFtuXDx
                                                                                                                                                                                                                        MD5:1B83BDE47892A049925572BD77B5E3B3
                                                                                                                                                                                                                        SHA1:998F7A3CED8FC72502A7108A5A64FC8D2505768F
                                                                                                                                                                                                                        SHA-256:5A953842AC9CA303D5159FB44F29251450DEA6B0F1DEA7556D6BC2A9AF28389A
                                                                                                                                                                                                                        SHA-512:39FD3A313AD2224EB5DA8CC32B7B3DD3462DE10748AAC64CB3E042ECAA5A756783845D4E1A1125833E428685A87D371AEADB45E80C558D0597D414DFB9186D67
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........'....$..@..P?...........,T.h..`........m.`..... L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`........c................C.,T.I..`B.......`......L`D.....Sb........2.....!...!...a.......!...........a......!......a.................!...!.............a...a.........x......................................................................................................Rb........124.`....Da.....!....a......Rc.s......getCLS...,T.(.`........`....]......Ha..........Kb.......... .c.................(Sb...........I`....Da....2....8....L.....Ia........Db............D`.......Q.`p........(..D..,T.(..`........m.`....]......ha..........Kb.......... .c.................(Sb...........I`....Dah........8....\e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da...........e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.js

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):66
                                                                                                                                                                                                                        Entropy (8bit):4.8128151418562695
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3:+BKSLDrbIoMLNLQJljRquKWLUCGA7LjL/n:+Dn4oRPDLUFsL/
                                                                                                                                                                                                                        MD5:B3E7D84CF0B8A2298C89F91F084C0809
                                                                                                                                                                                                                        SHA1:CE8389EE3CDEBD3DEA5628A441971C723D835D8C
                                                                                                                                                                                                                        SHA-256:E9FFA7AB9823450EDDC6F312504281D6C9D87BDD89B3E4B4478C2E22FAC1E55B
                                                                                                                                                                                                                        SHA-512:69BD25B2F3F76A8A763749C91745828A1EB05B103A543BF691D72757CE9E70F3EBC1D153F094ED081CE06172F62AC3E8CBD1E69849B92854C32693D2915510D5
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:nw.Window.get().evalNWBin(null, "static/js/3.cf9f4ce6.chunk.bin");

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.js.map

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):9898
                                                                                                                                                                                                                        Entropy (8bit):5.1083863257804785
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:192:fHLn4vlsHvjvxo7FUhWnl68oC4k0XiajoQgJhMiatsCPOQ:fHL4vYvjvxo7Fq8oCmXiajsWmQ
                                                                                                                                                                                                                        MD5:B079CA1E88F9F0249B645CF6809C0059
                                                                                                                                                                                                                        SHA1:4AE49B4802E3ECDDCBC00E54487B1ED6A2DB66F8
                                                                                                                                                                                                                        SHA-256:C43B883FF47319D6301976F55CBA18CDCF29DB95D79EDED8926C9C4FF93AE76F
                                                                                                                                                                                                                        SHA-512:4F9F19403A05360738085E3D1849A86F20124EA04635F0DE4806C65EDEA26812D23CA1AF0AA7DC7201BC7EEE9B0E5B80FF58214718BA3114F65CEE716439BB21
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:{"version":3,"sources":["../node_modules/web-vitals/dist/web-vitals.js"],"names":["e","t","n","i","a","name","value","delta","entries","id","concat","Date","now","Math","floor","random","r","PerformanceObserver","supportedEntryTypes","includes","self","getEntries","map","observe","type","buffered","o","document","visibilityState","removeEventListener","addEventListener","c","persisted","u","WeakSet","Set","f","has","s","hadRecentInput","push","takeRecords","m","p","v","timeStamp","d","setTimeout","l","disconnect","startTime","add","performance","getEntriesByName","requestAnimationFrame","h","passive","capture","S","y","w","g","entryType","target","cancelable","processingStart","forEach","E","L","T","once","b","getEntriesByType","timing","max","navigationStart","responseStart","readyState"],"mappings":"8GAAA,+MAAIA,EAAEC,EAAEC,EAAEC,EAAEC,EAAE,SAASJ,EAAEC,GAAG,MAAM,CAACI,KAAKL,EAAEM,WAAM,IAASL,GAAG,EAAEA,EAAEM,MAAM,EAAEC,QAAQ,GAAGC,GAAG,MAAMC,OAAOC,KAAKC,MAAM,KAAKF,OAAOG,KAAKC,MAAM,cAAc

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.bin

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):465368
                                                                                                                                                                                                                        Entropy (8bit):6.14942830048273
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:s+MUPkfXHj7+mCQmv5b7sSQyc6bwQEtlFiiE2Udd7sgoycSgaJ7sgo07sgoyoJ3z:zFPkP/+mCVGrDXtwYdvgk
                                                                                                                                                                                                                        MD5:5D4D79F5E8C4C5BE596D0D29FE390DB8
                                                                                                                                                                                                                        SHA1:BE21E4FB8E1068A14754A02BD6189A38240B0047
                                                                                                                                                                                                                        SHA-256:6F0FE0DF3138C4D6793991EA974B6F63F982F86652E8DDFC4E33EE70A5EFB88C
                                                                                                                                                                                                                        SHA-512:20CC4165405DC4E0EDEC3AC1713973EB94DAAAAF26EA6CB5FC9EB59321DC85583182916E125744D4C85FAD26F89C1CF08EA8A7F67C036F3BED5571157EBF3035
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.............$..@...............,T.]...`l.......m.`.....5.L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`......L`.......`......Mc...........................`.......La..........Ec.................E`.....Eg.................................E...........................................................................................................................................................................................................................,T.8.`".......`......L`......Rc.b.....require...Rb........fs.....^.......@a..........Kc..........(...8.g............!......b...2.........$Sb............I`....Da............b.......... ..L.....Ia........Db............D`........Q.`l........<..,T.8..`".......m.`......L`.....L..Rb.2M....net....^.......pa..........Kc..........(...<.g............!......b...2.........$Sb............I`....DaB...........b.......... ..de..........................,T.8.`".......`......L`.......Rb...h....http...^..

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.js

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):69
                                                                                                                                                                                                                        Entropy (8bit):4.8761250011309585
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3:+BKSLDrbIoMLNLQJljRquKGnteyCLjL/n:+Dn4oRPLtfCLjL/
                                                                                                                                                                                                                        MD5:99282C810B1320DD7DDF3F1E3C49BCB3
                                                                                                                                                                                                                        SHA1:412001989210C2675F1F0F6867E7B76243D37B31
                                                                                                                                                                                                                        SHA-256:77E053252D75F968C929769601E19EA05BBBB628307B99B23DBFE6DA511F9936
                                                                                                                                                                                                                        SHA-512:953288399F2B8E45D37A8BBEF6D48725F303143E144077C265346A0D900AB1AE8FE8A22B543BC32E8E37C80C840ED1AEBA6C0CC603B0DE126EFFE92B194166AA
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:nw.Window.get().evalNWBin(null, "static/js/main.717b6389.chunk.bin");

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.js.map

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):703789
                                                                                                                                                                                                                        Entropy (8bit):5.361726899305513
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:ccRN7mydOkBzbSqWTxlm4lxnXsQ2hVzhvFvVu7/QvLGCXB/qkcJ7aB71NxTKXY2R:GkkrlwvB7nWr
                                                                                                                                                                                                                        MD5:2A430BD7263C0FF637BCE16595B14F25
                                                                                                                                                                                                                        SHA1:1DDA5EB0085930E7F36C947799D7806F08C73D4B
                                                                                                                                                                                                                        SHA-256:1095AB40B990F5B4BB57121D8A0DFA575D727B2BA227576260496C1F1E39CFA3
                                                                                                                                                                                                                        SHA-512:340521BC1857EF3A8CF9EF2A247AD89C52BB481DAEA26200C23614D42D0BDC09EAD66356E7FA0D46C7EE1687125C5CAC4B2EC40E43DD863256A3894224317CA1
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:{"version":3,"sources":["../external \"fs\"","../external \"net\"","../external \"http\"","../external \"https\"","../external \"path\"","store/actionTypes/appActionTypes.js","store/reducers/appReducer.js","store/actionTypes/windowsActionTypes.js","store/reducers/windowsReducer.js","store/actionTypes/startMenuActionTypes.js","store/reducers/startMenuReducer.js","store/actionTypes/settingsActionTypes.js","store/reducers/settingsReducer.js","store/actionTypes/searchActionTypes.js","constants.js","store/reducers/searchReducer.js","store/actionTypes/offerActionTypes.js","store/reducers/offerReducer.js","store/actionTypes/topbarActionTypes.js","store/reducers/topbarReducer.js","store/actionTypes/notificationsActionTypes.js","store/reducers/notificationsReducer.js","store/actionTypes/widgetActionTypes.js","store/reducers/widgetReducer.js","store/reducers/rootReducer.js","store/store.js","store/actionCreators/appActionCreators.js","store/actionCreators/windowsActionCreators.js","store/actionC

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.bin

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):6880
                                                                                                                                                                                                                        Entropy (8bit):5.780693101615468
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:192:xic+H+F/xHMah4jd7U/qVvKcg9VSSZ3QpADbiEBzN+W5RTXY:jCQ1XkWCVicg9VDgpNYTRk
                                                                                                                                                                                                                        MD5:4FA32B7B0E24BED1A9E2E639180C6DAC
                                                                                                                                                                                                                        SHA1:929ECB83121E556DED3E3757CDF15F77CB215A66
                                                                                                                                                                                                                        SHA-256:088A11BAAE726E4380E8CD4EF349AF27C15A574443F825BB94703B845E6B1F7B
                                                                                                                                                                                                                        SHA-512:784F6C3D98B21B7E9A7442075D9C122AC04426D462A34FCCFD9394884AE18BEF8A5C742A4B8A6773DCA7D3E8A83032B736597804FD26FE631018E2C39C27D33E
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:........>....$..@...............,T.4..`........m.`......L`.....,T....`........`.....xL`8....\Sb..............!......a.......!...!....f$...........................I`....Da.........,T.-..`........`.....(L`..............................B...........(a.........xK|.....`.H...................8......c.(.<...0.......#.H..................(.<...H.............(.....{....$... ...<........x............/...../...../.....}..-...n...Y../...!...-....-....-......._......$...../....-........./..../...^........4.. ..P"..\.#...Iw...$.....;....$.-.!...-....-..%.-..'._....)......./.+.4..-...:./.......b..0-..2..-..4.]..6.a.8...:...-....-..;........}=._....>...a.@...(Sb.............a.`....Da....P.... .8..lB........ ........P...... ...../..........P...p.`.@..L.....Ia........Db............D`.....T.Q.`&...........$..,T....`........m.`......L`.........r............Pa.........HKp~.......<.......d...........T.........?........!..<. ........g.... ...P................-...n...q...../........-...n...#../.......

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.js

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):71
                                                                                                                                                                                                                        Entropy (8bit):4.7442478245494595
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3:+BKSLDrbIoMLNLQJljRquKeOISOBnDsHKsen:+Dn4oRPxOIRhC8
                                                                                                                                                                                                                        MD5:07D51995B0C40EB6A7D648682400933E
                                                                                                                                                                                                                        SHA1:673509F2150E63B0B1C2DA099AAB362214571CBD
                                                                                                                                                                                                                        SHA-256:F3AB2E215ED0CB5A170CECF2AF7B323810F0E48ACC15F255A9F87CFC2EFF8ECD
                                                                                                                                                                                                                        SHA-512:79026CBCE83B9C1589B6A77F81842AA4D9015E645CDB8FC0BABCE54118897A45F4D1AC82787476FC7BAA9C71AE7BD6FA38DCCAE12884A8AB6152A316D69CEECC
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:nw.Window.get().evalNWBin(null, "static/js/runtime-main.cdd4f9cc.bin");

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.js.map

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):12604
                                                                                                                                                                                                                        Entropy (8bit):5.32907166018772
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:384:fUPtHULTmhOVrLDtitZ3Rud/vSwmQFy9UFTmCaFmD5X7hNPn:cPtHU0SvSwmQJFTmCaFoLbPn
                                                                                                                                                                                                                        MD5:C7F90D5C550BFEECD43C415429428E79
                                                                                                                                                                                                                        SHA1:0D542CE39CD81D11AC9A73A3C0F81219DFB2E986
                                                                                                                                                                                                                        SHA-256:94AD0934D5C3FA12061BFF99B5CB495C0B6583E126E0D3CC99DCA62DCFFD8151
                                                                                                                                                                                                                        SHA-512:092EDF55040DFC6EBA370A4A4F15397F2B25363A45FB9D686493EBAB669A9864C42483EDFF23BC708BC77537B52292F4D71FAA706DB4D7DD2649DBE4FA922F96
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:{"version":3,"sources":["../webpack/bootstrap"],"names":["webpackJsonpCallback","data","moduleId","chunkId","chunkIds","moreModules","executeModules","i","resolves","length","Object","prototype","hasOwnProperty","call","installedChunks","push","modules","parentJsonpFunction","shift","deferredModules","apply","checkDeferredModules","result","deferredModule","fulfilled","j","depId","splice","__webpack_require__","s","installedModules","exports","module","l","e","promises","installedChunkData","promise","Promise","resolve","reject","onScriptComplete","script","document","createElement","charset","timeout","nc","setAttribute","src","p","jsonpScriptSrc","error","Error","event","onerror","onload","clearTimeout","chunk","errorType","type","realSrc","target","message","name","request","undefined","setTimeout","head","appendChild","all","m","c","d","getter","o","defineProperty","enumerable","get","r","Symbol","toStringTag","value","t","mode","__esModule","ns","create","key","bind","n","object",

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\copy_icon.570b8027.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1370
                                                                                                                                                                                                                        Entropy (8bit):5.283353360674453
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24:2dVm5AXxGvObLfE6odI4/UB4esb1Fke5UZZMQQZn5/ZyY2nOFUig2FLy8:cVqAXQ8fEhN6obDUZZOPyPncUhyy8
                                                                                                                                                                                                                        MD5:C28FE12628EAF4B73719080A13F8E1A5
                                                                                                                                                                                                                        SHA1:4900054A3A0BA37B054F7E99826AF0008928AAB5
                                                                                                                                                                                                                        SHA-256:EDEA379F1A676ED9E3ECF876A940EF2B6E8D9FB16804187D534CAE46F66F9BD1
                                                                                                                                                                                                                        SHA-512:6E1A2CE50D6B545A26011D8E3339F4FA4C228FBEFEC53A9177BE51DBB12C3C0FDFA33B2A6490F89211647ADC4D8A38A1B34ECC1114DE6C6A8013A51F2DBB58B8
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<?xml version="1.0" encoding="iso-8859-1"?>.. Generator: Adobe Illustrator 18.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">..<svg version="1.1" id="Capa_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 210.107 210.107" style="enable-background:new 0 0 210.107 210.107;" xml:space="preserve">..<g>...<path style="fill:#c3c3c2;" d="M168.506,0H80.235C67.413,0,56.981,10.432,56.981,23.254v2.854h-15.38....c-12.822,0-23.254,10.432-23.254,23.254v137.492c0,12.822,10.432,23.254,23.254,23.254h88.271....c12.822,0,23.253-10.432,23.253-23.254V184h15.38c12.822,0,23.254-10.432,23.254-23.254V23.254C191.76,10.432,181.328,0,168.506,0z.... M138.126,186.854c0,4.551-3.703,8.254-8.253,8.254H41.601c-4.551,0-8.254-3.703-8.254-8.254V49.361....c0-4.551,3.703-8.254,8.254-8.254h88.271c4.551,0,8.253,3.703,8.253,8.254V186.854z M176.76,160.74

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_calculator_gray.f29de877.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):5175
                                                                                                                                                                                                                        Entropy (8bit):3.933853115875902
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:FJpkgJIjAwPNke13W1eKL7T2+mb93ore1phgUT2v+CS:FJpk15zN1rhgUT2v+CS
                                                                                                                                                                                                                        MD5:CF8666E7736704C07412232858C9CBA3
                                                                                                                                                                                                                        SHA1:EE8666C41448498D22620353C27EB8489D763249
                                                                                                                                                                                                                        SHA-256:E1E0907E45A212DD9EAD8243A6C1B07907BE5E51F4399AAB6531E285322B1925
                                                                                                                                                                                                                        SHA-512:332195DB62034A4FB5D6D86B9F25BFBA5EF57C77B57EECDA23B9D5CB0D129B5684215C8DD45300B8A611926C3A593FF6447454F7B0A97B6FBC010C9B82DF8B1D
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M1.16071 0C4.77679 0 8.37054 0 11.9866 0C12.0089 0 12.0089 0.0223228 12.0312 0.0223228C12.7232 0.156251 13.1696 0.647323 13.1696 1.36161C13.1696 5.44643 13.1696 9.55357 13.1696 13.6384C13.1696 14.4196 12.5893 15 11.808 15C8.32589 15 4.84375 15 1.36161 15C1.16071 15 0.937499 14.9554 0.758927 14.8661C0.223213 14.6205 0 14.1741 0 13.5938C0 10.8705 0 8.14732 0 5.42411C0 4.08482 0 2.72322 0 1.38393C0 0.959823 0.156249 0.580358 0.491071 0.3125C0.669642 0.133929 0.915178 0.0446429 1.16071 0ZM12.2768 7.47768C12.2768 5.46875 12.2768 3.4375 12.2768 1.42857C12.2768 1.02679 12.1205 0.870536 11.7188 0.870536C8.28125 0.870536 4.84375 0.870536 1.42857 0.870536C1.02678 0.870536 0.870534 1.02679 0.870534 1.42857C0.870534 5.46875 0.870534 9.50893 0.870534 13.5491C0.870534 13.9509 1.02678 14.1071 1.42857 14.1071C4.86607 14.1071 8.30357 14.1071 11.7188 14.1071C12.1205 14.1071 12.2768 13.9509 12.2768 1

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_calculator_white.cdac319f.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2823
                                                                                                                                                                                                                        Entropy (8bit):4.491649868709728
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:cSA+fE1jgL58sH7b8NaRB0sKWDvFqfsGzlaQSUU+m2ALAX92VHcX12rtDkU5:W+fom1bbgEB0sKWDgUwlaMU+m2ALAt2d
                                                                                                                                                                                                                        MD5:0F2E1681746D0E29CF14FE6D88B557D7
                                                                                                                                                                                                                        SHA1:BB983801F298AF8693088BC47C6B62C5640D0BDF
                                                                                                                                                                                                                        SHA-256:E958BEC8452B258F1A9103B8C5CA2ABE6ADDA0FA0F6D1D443E5122CF79BA1CB9
                                                                                                                                                                                                                        SHA-512:C9BEBE4EBAE0C26B0355FEAEADA465CB111C740E2251279ABFBDC722C6E5A2B5780D136E23F256FD8B9A5013588789EA74021E11E472CDC4C181A57978889179
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 22.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 14 15" style="enable-background:new 0 0 14 15;" xml:space="preserve">..<style type="text/css">....st0{fill:#FFFFFF;}..</style>..<g>...<path class="st0" d="M1.2,0C4.8,0,8.4,0,12,0c0,0,0,0,0,0c0.7,0.1,1.1,0.6,1.1,1.3c0,4.1,0,8.2,0,12.3c0,0.8-0.6,1.4-1.4,1.4....c-3.5,0-7,0-10.4,0c-0.2,0-0.4,0-0.6-0.1C0.2,14.6,0,14.2,0,13.6c0-2.7,0-5.4,0-8.2c0-1.3,0-2.7,0-4C0,1,0.2,0.6,0.5,0.3....C0.7,0.1,0.9,0,1.2,0z M12.3,7.5c0-2,0-4,0-6c0-0.4-0.2-0.6-0.6-0.6c-3.4,0-6.9,0-10.3,0C1,0.9,0.9,1,0.9,1.4c0,4,0,8.1,0,12.1....c0,0.4,0.2,0.6,0.6,0.6c3.4,0,6.9,0,10.3,0c0.4,0,0.6-0.2,0.6-0.6C12.3,11.5,12.3,9.5,12.3,7.5z"/>...<path class="st0" d="M6.6,1.8c1.4,0,2.9,0,4.3,0c0.4,0,0.5,0.2,0.5,0.5c0,1.1,0,2.3,0,3.4c0,0.4-0.2,0.5-0.5,0.5....c-2.9,

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_check_gray.fc098a35.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):854
                                                                                                                                                                                                                        Entropy (8bit):4.266600052838456
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24:twdvCuJNOLLgF1Q+HmplV5c0L/IgT6REUXvdZSz0LU:6dYAuZZrIgTJOvfy0Q
                                                                                                                                                                                                                        MD5:6D54B2DFCD9A05985B1D2BDDFD513F60
                                                                                                                                                                                                                        SHA1:DE6A21F663DB8895ADC4DB91BBD08A279301322F
                                                                                                                                                                                                                        SHA-256:5586C361B2D63F488784A4140DBCC1A5D81FEB5ECB747CFCB420597D325F47BC
                                                                                                                                                                                                                        SHA-512:E9A6C7ED962B0972E2DD333DA6340D721BF9BD4840B50E8D8A074AF315D2C3ED5502415856FD888FC3CD35116E013E18450EEFB8DD11BB03E9829CB886A8EDED
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="#444444"/>..</svg>..

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_check_white.f080410d.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):852
                                                                                                                                                                                                                        Entropy (8bit):4.275850671375772
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24:twdvCuJNOLLgF1Q+HmplV5c0L/IgT6REUXvdZSz0LHA:6dYAuZZrIgTJOvfy00
                                                                                                                                                                                                                        MD5:2CCC89303FC39BE9450730A8B415E094
                                                                                                                                                                                                                        SHA1:F2E2BEB598038D58CC094C1AD1DEA58F2BB5F1BE
                                                                                                                                                                                                                        SHA-256:E7503A4E3E81C886FAF1B512F0BA5A409927D8B192E329FF1BB6882816B6FA85
                                                                                                                                                                                                                        SHA-512:D0E5C8118C813E786555CC2CD73D7D9BA0457A163E1D1F9B357A00A13DACCDC8E2963441C4CAFB07B960AF2980AF908E511DC74BC3BEDC3F5CCD25C7BD33EC08
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="white"/>..</svg>..

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_clipboard_gray.c8a9351b.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):4743
                                                                                                                                                                                                                        Entropy (8bit):3.9546492458044593
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:WvGuaiHhGE3LbNnWnbzPPFUKEcgVGoa59g04szf5u48xMg3vf:WOhiHJe3PPFUhc4Go8s6fAks
                                                                                                                                                                                                                        MD5:386F6BF2308D42F9D6E2B56C6BFB0C51
                                                                                                                                                                                                                        SHA1:F59465E5D827949B20728DE697019C28F3E58C78
                                                                                                                                                                                                                        SHA-256:4091F05BAFD814DA9D094477C087FEBAD0ADBC9910CFF507EEAC4B58FD207139
                                                                                                                                                                                                                        SHA-512:FB972C58B6B05BFF4D625807B675855C3CD4112D798361DCDAFD8F26521684FAA69EEEC380043DB21759EE51727315BB2632AFE03CB3CB57AB684D5CD9A065D8
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_clipboard_white.2afacb39.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):4729
                                                                                                                                                                                                                        Entropy (8bit):3.9826071199242548
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:WvGuaiHhGE3LbNnWnuzUPFUKEcpVGda59g04Rzf5u47xMg3vc:WOhiHJegUPFUhc7Gd8slfA9X
                                                                                                                                                                                                                        MD5:7B3329DB8105F1C10A0432343AA96772
                                                                                                                                                                                                                        SHA1:4AC72B85DCF695F50F6DD28A37B98A21DBAB0AF3
                                                                                                                                                                                                                        SHA-256:50FDF658E0D765F71D1265B574BA6EE514AF0BFC6057CEAC817E84906BA1A627
                                                                                                                                                                                                                        SHA-512:6E844379BDE23E22A19739B405F8193ABFE0C1A640D46C0004747CDBC41228B5E6C4A0428479EC38DDD1A7D60BAE247E44E05877357F3BDFE6BFB53592F1B5E1
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_cross_gray_2.01bfd543.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1592
                                                                                                                                                                                                                        Entropy (8bit):4.004290849514056
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24:tVvnjuJt7JBGAYIhm2mrLaqtQuFSgjmBwaonaOSvxZG2LvwuZ3+DExmbRlpQmNcs:rn6zGIkJrLTFVmKoZJLQ4gRCai6fWM
                                                                                                                                                                                                                        MD5:D9F81AE3849F84F6F219B2831F088247
                                                                                                                                                                                                                        SHA1:A0F7835AA9CD1261E3E2839B41055A3DD24A8637
                                                                                                                                                                                                                        SHA-256:DA9DFE3D7B3033B518E8E2BD6C708A0F30F28E6013E696F8CEF108D2B64E0F35
                                                                                                                                                                                                                        SHA-512:21D60604A97B9C084D924EA8C3C258990F818F2D44621C5F7D14380736BCF05ACDFF0DF31C5F9E71EAF68977FD2CA790E57AA6FFBF803DE1F88A45FAEBD3587F
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_cross_white_2.05921d5e.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1590
                                                                                                                                                                                                                        Entropy (8bit):4.012220474436418
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24:tVvnjuJt7JBGAYIhm2mrLaqtQuFSgjmBwaonaOSvxZG2LvwuZ3+DExmbRlpQmNcX:rn6zGIkJrLTFVmKoZJLQ4gRCai6fQ
                                                                                                                                                                                                                        MD5:4DB5D94C4F838E720E17332EDF740EBC
                                                                                                                                                                                                                        SHA1:D28ED3AD9E3A5EFE37DD1012C5F9F1E494C32883
                                                                                                                                                                                                                        SHA-256:52151748BF54BE05AD5D26EB0FE3209E5EAFDEDB04AF6F1EB80D758E375A3E6C
                                                                                                                                                                                                                        SHA-512:8264399F4119897182DFA43EA447DA2EF80ED6451677A66C12ECC4547BDCBD0762AA11CC3D89E948A32CA1C4B59952B267B2FADBDCB84A827E7DB2D66777837C
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_dashboard_gray.3a181243.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):4264
                                                                                                                                                                                                                        Entropy (8bit):3.894045254391696
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:+JHedx8iSdAwpGi30T09xMR99wgr+rBKD0iMt9V0BG:+JM+v+0fswcDMt9VgG
                                                                                                                                                                                                                        MD5:E25CBB3FF275E58AF7891E0B857550A1
                                                                                                                                                                                                                        SHA1:5FA0E6C032B080FC7A2E37ACADAA46D7F7AB04E2
                                                                                                                                                                                                                        SHA-256:25FFBB8EEAC1F9A707570095599CE2349846836631CB2233D8273B4180425213
                                                                                                                                                                                                                        SHA-512:BE2E449A4E86B723CA3881547F2CF11A305269EDE4DCB62EB94EEF44FC72E99EB0AE95B253735BD69BF10E814512B93AD8420193AF13598D0CEC987AA5F2A6C2
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="20" height="21" viewBox="0 0 20 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.7624L19.9644 10.7985C19.7505 11.593 19.2514 11.9903 18.4315 11.9903C16.542 11.9903 14.6525 11.9903 12.763 11.9903C12.6204 11.9903 12.5135 11.9903 12.3709 11.9903C11.4796 11.9903 10.8379 11.3402 10.8379 10.4374C10.8379 9.78739 10.8379 9.17347 10.8379 8.52344C10.8379 6.32057 10.8379 4.1538 10.8379 1.95092C10.8379 0.903652 11.1231 0.506411 12.0857 0.181396C14.3316 0.181396 16.542 0.181396 18.788 0.181396C19.1088 0.289735 19.4653 0.434186 19.6436 0.723088C19.7862 0.939764 19.8575 1.19255 19.9644 1.44534C20.0001 4.58715 20.0001 7.69285 20.0001 10.7624ZM18.7523 6.14C18.7523 4.69549 18.7523 3.28709 18.7523 1.84258C18.7523 1.55368 18.7167 1.51757 18.4315 1.51757C16.435 1.51757 14.4386 1.51757 12.4422 1.51757C12.157 1.51757 12.0857 1.55368 12.0857 1.84258C12.0857 4.69549 12.0857 7.58451 12.0857 10.4374C12.0857 10.7263 12.157 10.7985 12.4422 10.7985C14.4386 10.7985 16.435 10.7985

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_dashboard_white.a91ae220.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):4238
                                                                                                                                                                                                                        Entropy (8bit):3.914834455290012
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:bMT1fU8EHCzbublIDQqirLwl4w1y97ZgILgzB:bS1giubk6kwtgILgzB
                                                                                                                                                                                                                        MD5:2A64F22D46EF697D361BC13F4E5EC382
                                                                                                                                                                                                                        SHA1:8F4277EA88024B458509538814E3A50BD20F0F04
                                                                                                                                                                                                                        SHA-256:33629801FE35C15E2803A47C1ED0B8E21F38114119F05D64EBD65E5DA246B7CA
                                                                                                                                                                                                                        SHA-512:6A9FC6FC4526D36FC259BF104F35418FB0914E32314975666E8EF01BC1D940263CC2F3109051E112A26A7FE42895762729F3FF5DC1E4C6D8ADF2A0E1CFD410E9
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.4456L19.9644 10.4813C19.7505 11.2656 19.2514 11.6578 18.4315 11.6578C16.542 11.6578 14.6525 11.6578 12.763 11.6578C12.6204 11.6578 12.5135 11.6578 12.3709 11.6578C11.4796 11.6578 10.8379 11.016 10.8379 10.1248C10.8379 9.48307 10.8379 8.87701 10.8379 8.23529C10.8379 6.06061 10.8379 3.92157 10.8379 1.74688C10.8379 0.713012 11.1231 0.320856 12.0857 0C14.3316 0 16.542 0 18.788 0C19.1088 0.106952 19.4653 0.249554 19.6436 0.534759C19.7862 0.748663 19.8575 0.998217 19.9644 1.24777C20.0001 4.34938 20.0001 7.41533 20.0001 10.4456ZM18.7523 5.88235C18.7523 4.45633 18.7523 3.06595 18.7523 1.63993C18.7523 1.35472 18.7167 1.31907 18.4315 1.31907C16.435 1.31907 14.4386 1.31907 12.4422 1.31907C12.157 1.31907 12.0857 1.35472 12.0857 1.63993C12.0857 4.45633 12.0857 7.30838 12.0857 10.1248C12.0857 10.41 12.157 10.4813 12.4422 10.4813C14.4386 10.4813 16.435 10.4813 18.4315 10.4813C18.7167

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_gamepad_gray.d7229273.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):6098
                                                                                                                                                                                                                        Entropy (8bit):3.8868971852897896
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:2masVg2zPxVlBJr0GVdGrp7YAFPa6aswXXoluwFw0wsOVmc0BLMpHLJklLMp+sLQ:+sVg2zPxjjVdgpMAFPaJ3HoluwFw0wVq
                                                                                                                                                                                                                        MD5:8EBCB6408685047BE3BD1996D4000EE4
                                                                                                                                                                                                                        SHA1:F16881FF86F16B8C4D725E17584ECE870CD6727F
                                                                                                                                                                                                                        SHA-256:BA281665918CA2AB863CE98626153153931F2D99FEE645F7479118F91C66C9F2
                                                                                                                                                                                                                        SHA-512:276FD1A09BDE77261210114F5FE6E3C796DAA6C85183CC206200B9BB0D148AB914981AE162A0D9FF901171A394A98708E672A8C002FDBEB4138488BF80944C5F
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_gamepad_white.25a7995d.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):6086
                                                                                                                                                                                                                        Entropy (8bit):3.9063223215918432
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:2masVg2zPxVlBJr0GVdGrp7YAFPa6RswXXoluwFw0wsOVmc0BLMpHLQklLxp+bLC:+sVg2zPxjjVdgpMAFPaq3HoluwFw0wVt
                                                                                                                                                                                                                        MD5:048482A7B181541A174551C016205A44
                                                                                                                                                                                                                        SHA1:5A5C2E2F813768E3C3C096ABDB209F55C5F2FCE3
                                                                                                                                                                                                                        SHA-256:968A15C711DA89D4A150521A1889633C5967731EAB81C6A14DFFA352B325BC7E
                                                                                                                                                                                                                        SHA-512:873070DE6578A9751FB2718F2C73E6ED8FA15F0C76C34D03E0A359658F5B885EFC5388DDDFB458CCFB99D44025983EAFCD595DE7C6218F1DAC81228D75F40F4C
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_gear_gray.545673b6.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):6801
                                                                                                                                                                                                                        Entropy (8bit):3.7386877939405805
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:192:VPxlcoEiWxAGY/Eetsf/k9aLNyh6JwpM2LkgL8en:Jx2CyAhtsE9aZLT/gv
                                                                                                                                                                                                                        MD5:6DD649E7B024D0758023476637791EFF
                                                                                                                                                                                                                        SHA1:47EAC14A729C1A1C314C644BD28FA8C7D8B6D24D
                                                                                                                                                                                                                        SHA-256:663F3C16A7075FF42266008720D8D859F54E366040496F95E828E892DCAE6A7E
                                                                                                                                                                                                                        SHA-512:3887A01D6329B979A683A6322508FD75C6C66369605133FBFA373E503CC2A199204002E5FEB382D163D67CB2DFBCD698AFB57C770916C1A5B6BB592261A1FE7C
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_gear_white.2bba31c1.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):6797
                                                                                                                                                                                                                        Entropy (8bit):3.744755737482207
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:192:VPxlcoEiWxAGY/Eetsf/k9aLNyh6JwpM2LkgLbe0:Jx2CyAhtsE9aZLT/gV
                                                                                                                                                                                                                        MD5:C29E6ED919C2A6DE97D06B2AE745DE71
                                                                                                                                                                                                                        SHA1:D5FBD0DBFBD471CE494FD822C8846D4460BD1545
                                                                                                                                                                                                                        SHA-256:2B35B1B5EAB5E23F2FE6E3B1178A81933241006D56FC2731E40323B5E6AEE94A
                                                                                                                                                                                                                        SHA-512:07C65E7CB30FA0D0B8054EDAB7AA9AA0625826C4327681E14AC06849C7DBD0722F2487D9564ADCF2CDF819352E78492B65620C0352F043818D4839674D21B2F0
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_notification_gray.e0145c50.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):3605
                                                                                                                                                                                                                        Entropy (8bit):3.914389459303166
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:FIQXafQMoWADNaEoUFXMl10h+DNs9eKjrOIntIE:F7XgiDNaEvs1SGCrOItB
                                                                                                                                                                                                                        MD5:477A237F6AE8615FA3C957919C161FFC
                                                                                                                                                                                                                        SHA1:735FF4EB4377A45B2D2D5A8E7C305F6B6AF287C7
                                                                                                                                                                                                                        SHA-256:A676CCE75141D03F6264C5D65398BE6021379FEF9A2BB25BA64549EFB8066B42
                                                                                                                                                                                                                        SHA-512:5663DA1BF748E3A62A4D5919C4E1FEFE95DF60AB46E9DA6C03B6417854CC9A516F38C5EA14AB21A775EA9D3BA0630D830AF7379CC62FC17E84EA18B402666D30
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="#494444"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_notification_white.addda272.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):3599
                                                                                                                                                                                                                        Entropy (8bit):3.928807214825618
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:FIQXafQMoW3DNaEoUFXMl10h+DNs9eKjrOIutI/:F7XgZDNaEvs1SGCrOIUu
                                                                                                                                                                                                                        MD5:89DD3B8D872E8E8E8D51B3CD29C77023
                                                                                                                                                                                                                        SHA1:E4D6DAA5097FFE044C8DF59692FC2F3ABCF45668
                                                                                                                                                                                                                        SHA-256:A2DC2F231B7A3492ABCED87D8F1953CF313CFE3CDD32B38FEC3F6EDD270A26FD
                                                                                                                                                                                                                        SHA-512:4E731CF642CBC3BEBC5C858073336B6D923227B690253378A47B8A5220E2F28EFC8D2D6602728F1DC2D13ED5EB95B5F889813FE89BBA7E55A6A487F01E510203
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="white"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305 13

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_screenshot_gray.01873dbe.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2232
                                                                                                                                                                                                                        Entropy (8bit):3.9969278840420657
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:h3bDj6YrB+De50bRzctlW9MMCQ1zzC0lm6xM:1Dj6YsymRzpCTQ1zzC0li
                                                                                                                                                                                                                        MD5:73CD1627E147A8EAD813AD7201D75876
                                                                                                                                                                                                                        SHA1:9873BA2A53794A91E4DFB617D0D713DCC1EF5AFA
                                                                                                                                                                                                                        SHA-256:27AF99AEF7A11E5806946F03234615F4F96576936C87BF3E256572AD6D35BB3B
                                                                                                                                                                                                                        SHA-512:5EE5A96FC914E6D2E4481003B817F8CFA647C447CBA2254EB83EC75E606DACBDA1520D0C0CAF789103B53FC47CB825539748E703CAC99D41BB02A1E64711C7CA
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_screenshot_white.0e82acc2.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2228
                                                                                                                                                                                                                        Entropy (8bit):4.011244246624798
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:h3bDj6YrB+De50bRzctlWRMCQ1zzC0lm6t:1Dj6YsymRzpRTQ1zzC0lt
                                                                                                                                                                                                                        MD5:D4950E85D1EDD93F20A610F0B9575A1B
                                                                                                                                                                                                                        SHA1:6CF6227A85D9111DBBD9A23A2BBA528D31B591A2
                                                                                                                                                                                                                        SHA-256:4702B18CB5FAA0D6F56176EBE21011D2E994736BA0AFC52C961E3950F45E61EA
                                                                                                                                                                                                                        SHA-512:15B47F230A966FEFCBE1BA1BC6D700FACF7978B22A7913388C3269D13A140AA634364121473A7152997EE5146FC5BED9697C00D7018F025CEB6BFB3018C64ABD
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_search_gray.ebbaf632.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):702
                                                                                                                                                                                                                        Entropy (8bit):4.39074490019929
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12:trVzNtuJlzaTATxgOyh0DIAK+aV/E4Ypk8FnOp8DQBW:tZzNtuJoTcxyu6fV7KbFnPsBW
                                                                                                                                                                                                                        MD5:86893B121171A45F3494D301D57E80F1
                                                                                                                                                                                                                        SHA1:739B6A99982CE3F6BF792876E72A8413D1583072
                                                                                                                                                                                                                        SHA-256:4D8B0003A1DA38931E9BA26483D517CD59E62EA14759FC36F14B0F1EC558C6B8
                                                                                                                                                                                                                        SHA-512:CABD9B44F635F3A1C9C8054004DE318FC3F875F6FD81DB722CD49FD29912E0720B656DD1BA81A5FF8B63C728A81A9A393618E0D18B07227F2AC937A954D9FEB0
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="#827A7A"/>..</svg>..

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_search_white.0c376446.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):700
                                                                                                                                                                                                                        Entropy (8bit):4.387297248681374
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:12:trVzNtuJlzaTATxgOyh0DIAK+aV/E4Ypk8FnOp8DQBiHAA:tZzNtuJoTcxyu6fV7KbFnPsBHA
                                                                                                                                                                                                                        MD5:C6D2A075413FDBCB286B77A97F9B6F13
                                                                                                                                                                                                                        SHA1:2DAA74C58338CAFE94A25CAB8FFB92253C140BCF
                                                                                                                                                                                                                        SHA-256:A71D66F5B6FAC238513DAA379BAEE5B35F24EC42050DC21E056BF08310042888
                                                                                                                                                                                                                        SHA-512:387762B3A3D0B7F694CF633926B3777AAA45DCA5A31DC7C095BC0B235B7D49CE5818BE76F2B032CF4E3031DEC520C5C67FAB879968C0F203E2A44EEA2EE0499F
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="white"/>..</svg>..

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_support_gray.a272cc7a.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):3466
                                                                                                                                                                                                                        Entropy (8bit):3.9394896115708424
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:qqr8WXm539LJck1/Syl7x6Ugu5mUctd2ji2REolr58DqJcgcBBs1Kmo6UZuEVlYd:4WXm53pJp/S86Uh58Gi2FV4ksShd
                                                                                                                                                                                                                        MD5:97A4CAA52C453393A3ACEDB7EB240010
                                                                                                                                                                                                                        SHA1:26353A64DD09BA4D0055D2F259266DABE7C1CC88
                                                                                                                                                                                                                        SHA-256:0A5439D793597DA248595B59290A41123A36BA90D47554ABE4E64147455BD86F
                                                                                                                                                                                                                        SHA-512:F1C236016CE294FDD70C584FAF045BF5DAF8DD4BBE2D453788CF78BB0397C61305C2C148651D9D8E52ECF08AF39264835781EF3A9496759870C7BA93A6BA2500
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20209 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_support_white.66ecfc42.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):3460
                                                                                                                                                                                                                        Entropy (8bit):3.951932320279216
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:qqr8WXm539LJck1qSyl7x6Ugu5mUctd2ji2REolr5RqJcgcBBs1Kmo63uEVlYanL:4WXm53pJpqS86Uh58Gi2FVLksSwa
                                                                                                                                                                                                                        MD5:7BBD80A02464154C092ACBE7DD328730
                                                                                                                                                                                                                        SHA1:C5E8862B03D566CCE19001910B1254D0293C1D9F
                                                                                                                                                                                                                        SHA-256:F6B4616A88E746054F75133B879556D769B8A16395EDE1EFC723112BD41E218B
                                                                                                                                                                                                                        SHA-512:53A0B00F505D6AC3B4E737540DD02036778BC89C521083352A20EE1E63136C4D72A9F6482752ADA6D8E415C6D384197FC393F5AED907A45F1209926DA9F80C48
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20208 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_trash_gray.4f9b6bc3.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):4403
                                                                                                                                                                                                                        Entropy (8bit):3.8960426134967934
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:sreYdijt0XCV30iqhzz9GaHPuPVsTasmBsoG2SuM2q6RW:saISGt95P6e2B4u7dW
                                                                                                                                                                                                                        MD5:360145CB691391CCC038500BAD652269
                                                                                                                                                                                                                        SHA1:4F2D87620766892151D6087962DCB08628FC1220
                                                                                                                                                                                                                        SHA-256:4E9DBDEE102A27F7B339857D9B888EB218E00456E42D1CE3747E4810DC4087C5
                                                                                                                                                                                                                        SHA-512:D2940AA1CBFC0ADE2AEFBCA312F077A23D84C7F4D1087D0D8FD87D9ADF7939AA9B2774AAE53B4A8F55AF4C946C7066193B5636FC44997F742B29A873E9EE5BEC
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_trash_white.1601c18d.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):4395
                                                                                                                                                                                                                        Entropy (8bit):3.9130769273478307
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:sreYdijt0XCV30iqhzz9GaHPuPVs2asmBsVG2SuMnq6Rx:saISGt95P6eRB9uidx
                                                                                                                                                                                                                        MD5:B0F49189BE082A137803BEA947266CC9
                                                                                                                                                                                                                        SHA1:8733164F238BB6BC95614B91715408EA54C54E57
                                                                                                                                                                                                                        SHA-256:042BEFCC06513E3E81506FE03F28CA2986A11731A70F958D1F0CE0095924412F
                                                                                                                                                                                                                        SHA-512:B3E007E8284E32AA9B20BE9161CE7641F7953A23104C69265ADBB8E689CE683C0FED86DE8FC682B27C10EBAD10C0A6385EC58A7450F91D8A5541F54402EFECFF
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_turnoff_gray.a7446394.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1858
                                                                                                                                                                                                                        Entropy (8bit):4.054255384536267
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24:tcoqAuJJhP7yShzrcOTpBqPmJT2cePJeSFu1uXfSVbxS6GRqkg+HqpYNOo5bASNQ:hqPY85FBgcAtu1QS8qkg+HIYZXtlkN
                                                                                                                                                                                                                        MD5:04FDC7FEDBD2538F8B4A24EC6A737DDB
                                                                                                                                                                                                                        SHA1:30EAAA4ECE1B1D47F846D1CF2B5B29753049335C
                                                                                                                                                                                                                        SHA-256:E649612224E5754F9FD4A7602847F932B58BF6B24A22A36029D782FD129054CD
                                                                                                                                                                                                                        SHA-512:18502FD6B8C17E3EE5EC89E9F9028710BB2BE57D2FB46282DDD3E7CE5C76F76FD17ECDFCC810F4B44FCE583937F10DD45C397449C374E4DBD7EFF2C12E36358C
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_turnoff_white.333d83c8.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):1854
                                                                                                                                                                                                                        Entropy (8bit):4.069519451091226
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:24:tcoqAuJJhP7yShzrcOTpBqPmJT2cePJeSFu1uXfSVbxS6GRqkg+HqpYNOo5bAH2y:hqPY85FBgcAtu1QS8qkg+HIY1XtlkB
                                                                                                                                                                                                                        MD5:FCA164880EE2E1D12B798C98241DCB76
                                                                                                                                                                                                                        SHA1:A8554FA6389771ECBB7A7C5FEB016EC3DD6C056E
                                                                                                                                                                                                                        SHA-256:5F591B87FE162601A488611DAEE8E89C6C0ABA9006DE926D75FC339224AA61E2
                                                                                                                                                                                                                        SHA-512:90C00A580BBB8C47AB0B88A52F7738AE6F3188F3E6964D7CBB7011680C4F5406FA61EF7EA8A6403D41CA429E3FFD9FFABEF4C948DCA86782515E99A057B1CE27
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_unpin_gray.712c1820.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2922
                                                                                                                                                                                                                        Entropy (8bit):3.8955256034331684
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:qqUqL0zHerZmOk5T7f/v+8JKgmEU5BdN5gxQsAvCSEkP2ME6nwnTW5IO:qoC+rZg5vuwyVBb5gxQHvREkP2Jl8
                                                                                                                                                                                                                        MD5:60F659C2639149E5FE452A99BA232B94
                                                                                                                                                                                                                        SHA1:70AB8FCF7714F5C83F9C7C749E95702273CEAF11
                                                                                                                                                                                                                        SHA-256:FA330061E57D90B2BBB6F9F24982991F574DEC5E697CBACFB2551BD6D6317CD3
                                                                                                                                                                                                                        SHA-512:25C728806C4C1501762A1D0446D18818BDDE667FE0681074541D3C8F4F2207F8DC8AA3A5F825CDE2F79E580BBA0F6C9189BBD9C2E11D261E57D4ECA78B83405D
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_unpin_white.6b8ad10f.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2920
                                                                                                                                                                                                                        Entropy (8bit):3.895777405127468
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:qqUqL0zHerZmOk5T7f/v+8JKgmEU5BdN5gxQsAvCSEkP2ME6nwnTW5Io:qoC+rZg5vuwyVBb5gxQHvREkP2Jla
                                                                                                                                                                                                                        MD5:610CC1A8CF2F609FCD872D217E3D4333
                                                                                                                                                                                                                        SHA1:91F5EBF7DFAA1F39123342EFF19176D4432C0388
                                                                                                                                                                                                                        SHA-256:AC401187E858B9BD7CAD7A638063B9808FA6545D6576BBEA41471C7336E6AAE2
                                                                                                                                                                                                                        SHA-512:E803E86F8090F205EBF3EF2E9796ECFD7B31485A89DFFA4B72785E3E721BFA67CEF2D1D8416352C320BC6556FF977FC9630A2E24551BA6CDB9965F2067B3CE28
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_weather_gray.6eb05cae.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):3445
                                                                                                                                                                                                                        Entropy (8bit):3.979453075901205
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:lFFqyQ7dtcTIAcq+/O53Jve2d923tqjvtLaTbVixmR/3dagOJj2xcS19kjJWtHGE:5q7HcUAT7mztiVLavIxmN3IZh2n
                                                                                                                                                                                                                        MD5:8517A7C9AC10921DEBA471DD89A13601
                                                                                                                                                                                                                        SHA1:55F06AA4A8E2C59CCBCF9EDFBF4A19192E921302
                                                                                                                                                                                                                        SHA-256:4AA2937B6A751F114A1CB7BE1A09ECEC436F70AF6350A17EAFF88A3D88262818
                                                                                                                                                                                                                        SHA-512:6EB83B5F88E0945C63550501FD856AB9E0B80C0827470124FF93342A7F8EB560CCF11AFEBC08D49F7BB55122EB6D22D0146E979D7A10F911233E17B77704DD86
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="27" height="23" viewBox="0 0 27 23" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26.576 17.9499C26.4889 18.2549 26.4453 18.5599 26.3582 18.8649C25.7918 20.9561 24.0056 22.5245 21.8708 22.7859C21.5223 22.8294 21.1737 22.8294 20.8252 22.8294C17.2527 22.8294 13.6367 22.8294 10.0642 22.8294C7.84227 22.8294 6.09959 21.3917 5.66392 19.257C5.44609 18.2549 5.62036 17.2529 6.14316 16.338C6.18673 16.2508 6.2303 16.2073 6.27387 16.1201C6.01247 15.9023 5.70749 15.6845 5.44609 15.4666C3.57271 13.6804 2.96277 11.502 3.70341 9.0623C4.44405 6.62255 6.18672 5.18485 8.7136 4.74918C11.3712 4.31351 13.9416 5.70765 15.1615 8.10383C15.2486 8.27809 15.3358 8.32166 15.51 8.36523C17.8191 8.5395 19.5182 9.62867 20.5202 11.6763C20.6509 11.8941 20.7381 11.9813 20.9995 11.9813C23.8313 11.9377 26.0968 13.9418 26.4889 16.7301C26.4889 16.7736 26.5325 16.8608 26.5325 16.9043C26.576 17.2529 26.576 17.6014 26.576 17.9499ZM15.5972 21.3046C16.5121 21.3046 17.4706 21.3046 18.3855 21.3046C19.3439 2

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\icon_weather_white.c0043930.svg

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):3425
                                                                                                                                                                                                                        Entropy (8bit):4.01234712901125
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:DKJzzcgT2SgblyFVQzNrd99EGDBBIO2sOlvu0+sGD0gfDOAHmD1MjQQnfvw8aN+F:+zzcWMlyFWJO5fYdHmDufv1aNs
                                                                                                                                                                                                                        MD5:0C92AF8318B8C3247643257AF05FD42E
                                                                                                                                                                                                                        SHA1:2DD447FF88BC4B9BC48324FEF75D9395867D7462
                                                                                                                                                                                                                        SHA-256:0503A1E65404853AE72D674F95D1ECB8EFCDF94B68A5B80EE8B59D7E77504A39
                                                                                                                                                                                                                        SHA-512:C5AACD08A30E34262FA433B29EC8971CC39E4675D9186C9D527641516CBB5C70B7F3138DF3AA3BD45677B4043F89DAC981C2F16D31ACD6A80226E4E43AB6107B
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="26" height="22" viewBox="0 0 26 22" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26 17.2979C25.9147 17.5917 25.8721 17.8856 25.7869 18.1795C25.2328 20.1948 23.4853 21.7063 21.3968 21.9582C21.0558 22.0002 20.7149 22.0002 20.3739 22.0002C16.8789 22.0002 13.3413 22.0002 9.84631 22.0002C7.6726 22.0002 5.96772 20.6147 5.5415 18.5574C5.32839 17.5917 5.49888 16.6261 6.01034 15.7444C6.05297 15.6604 6.0956 15.6185 6.13822 15.5345C5.88249 15.3246 5.58412 15.1146 5.32839 14.9047C3.49565 13.1833 2.89895 11.0841 3.62352 8.7329C4.34809 6.38173 6.05296 4.99623 8.52503 4.57638C11.125 4.15653 13.6397 5.50005 14.8331 7.80923C14.9183 7.97717 15.0035 8.01915 15.174 8.06114C17.433 8.22908 19.0952 9.2787 20.0755 11.252C20.2034 11.4619 20.2887 11.5459 20.5444 11.5459C23.3148 11.5039 25.5311 13.4352 25.9147 16.1223C25.9147 16.1643 25.9574 16.2482 25.9574 16.2902C26 16.6261 26 16.962 26 17.2979ZM15.2593 20.5307C16.1543 20.5307 17.092 20.5307 17.9871 20.5307C18.9248 20.5307 19.8198 20.

                                                                                                                                                                                                                        C:\Users\user\PCAppStore\ui\static\media\in_background_auto_update_img.dd2961b8.png

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        File Type:PNG image data, 490 x 140, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):11957
                                                                                                                                                                                                                        Entropy (8bit):7.943985153985361
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:192:jSTZR77SSlsXp7h9PKr6L1KJ9yRh/+AogjkisWttJkuzTCFvm9e4t4L6swiagy76:WJsV0e1j+AoGsWtxWqCJHHNi0
                                                                                                                                                                                                                        MD5:5D3291D90D252B1C09C262466D67D04A
                                                                                                                                                                                                                        SHA1:0AFB93843C13CC71B458D92E5400FC756FEC5691
                                                                                                                                                                                                                        SHA-256:4192A0833E3F06C4B9B563BA5777A3CBFAA69BCBA6DF233889540709772FF082
                                                                                                                                                                                                                        SHA-512:B14F315D3C3A7F7EEEB758774DCC0F3891087DCC79C2A30C61E27F401F04AFDD18D0393AA7CFA4E56A41F6F295AF0716920B313653D095ADB5CE56E18804EEE1
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a....JIDATx..}p..}.b......l.`...cp.p..$....M...$...6.I.o...i...N.f...L.G.M..8.f...0..,$1..........3.X....=.s........+..~f4..=.y?.w~..9.i.c.Q'..B.<2..'..B.."A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..17...2........&wS.m..^..r..x......kC/9!..b..r..m... ..=.GA@g.j..7...I`.!..I..RP..y.k.....^....kCn.....wB.!..`...E.q9.}......q-7..z._Z|.......T0o.....7...~......+.n....Y.q.+.5....IW.O..~o.....Y...].Y....v.....~w..{.../..?..g..y...?...x..g...'....zA...o...7o..........R......W)...k........._..[{....|..?..?.Y..?......O.`.{<..j..dtt.......Q-...c_..S.Zz<G.R?.so.....H...}.I..o}....cuiy......_y.}...s---..O~5..g.wB.Q.......k..z@X.....t..._.qn.]w.A..D..<......@.,.=....>.v.u.{.....s...4..ou.>......7....o.-.X.Tz.....

                                                                                                                                                                                                                        Chrome Cache Entry: 278

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:HTML document, ASCII text, with no line terminators
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):13
                                                                                                                                                                                                                        Entropy (8bit):2.7773627950641693
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3:qVZPV:qzd
                                                                                                                                                                                                                        MD5:C83301425B2AD1D496473A5FF3D9ECCA
                                                                                                                                                                                                                        SHA1:941EFB7368E46B27B937D34B07FC4D41DA01B002
                                                                                                                                                                                                                        SHA-256:B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
                                                                                                                                                                                                                        SHA-512:83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://td.doubleclick.net/td/ga/rul?tid=G-VFQWFX3X1C&gacid=189414535.1730914672&gtm=45je4au0v898645365za200zb9103256652&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101823848~101878899~101878944~101925629&z=17613073
                                                                                                                                                                                                                        Preview:<html></html>

                                                                                                                                                                                                                        Chrome Cache Entry: 279

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):438959
                                                                                                                                                                                                                        Entropy (8bit):5.626383635741626
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:N4wGTFhCGLgB40oTUzWRSR9cM8rT/o2+YUZ9Or24Avd:GwiFhjc40oTOHYmYw
                                                                                                                                                                                                                        MD5:439B481575681FA196D5067E114E3A1B
                                                                                                                                                                                                                        SHA1:27448EB451C893F79BE275284249C0D00424B690
                                                                                                                                                                                                                        SHA-256:B8F8EE4D4FF8D6113C0BF529386D7D46E71882C23EE3E596117E33AA4F89181B
                                                                                                                                                                                                                        SHA-512:9364D74F329832C0E73276ED8E24EB299855559ED20E60916B99DEC0A51587CED64AA3DF160BD9BBB040884F21C8FC3D73F6B3D5885AB6FB731A9229FC628AC5
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C
                                                                                                                                                                                                                        Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                                                        Chrome Cache Entry: 280

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (4871), with no line terminators
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):4871
                                                                                                                                                                                                                        Entropy (8bit):5.843408731396158
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:1gWUfvlcY021mvn1blhad7OIJoodnbUp2dEjkRUNJb9CcrD:1DY0hf1bT47OIqWb1wJb9trD
                                                                                                                                                                                                                        MD5:289483C61DA235F7B557409194DBD0E5
                                                                                                                                                                                                                        SHA1:ADD65BC0505502D06B7B31E8FA50F333078F8797
                                                                                                                                                                                                                        SHA-256:47D7F3E6ABDCF144ED629CC3C0BE6AC6A17B74843C240E5607020E5B43FA7BDF
                                                                                                                                                                                                                        SHA-512:C9E26E12D1CDF4314150B148BBC5210E75E8506191E5960E103510F41689530E7A9D3761523582B7427A9629913B31561D6FA4C78C45EB8F22A134CCEC945CF2
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                        Chrome Cache Entry: 281

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):438985
                                                                                                                                                                                                                        Entropy (8bit):5.626616011002078
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:N4wGTFhCGLgB4doRUzWRSR9cM8rT/x2+YUZ9Or24Avp:GwiFhjc4doROWYmYw
                                                                                                                                                                                                                        MD5:23C55D0BEC8306CEA0C003C5211F6435
                                                                                                                                                                                                                        SHA1:89B7A637D0C5ADBE731E49D0AD34164AB6504AAB
                                                                                                                                                                                                                        SHA-256:2C783A94988BAEC09414D17695B9B1980E68638B811445FC7A8D7B0A491834B4
                                                                                                                                                                                                                        SHA-512:ED3A33C32B1FD54745AFFE78DC6FC23CEB4B7E41E4B74918523A1ABEDFF4162717FB38B46A143E842A6F3B1EE83769EAE364D87687DECD2CFE61FD8317D42267
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                                                        Chrome Cache Entry: 282

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):3592
                                                                                                                                                                                                                        Entropy (8bit):4.71780114350715
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:XlbKIGVo4FFr2s2wVix2FFCCQ86TqYeZEB:XVFCXc+ixi4lTPB
                                                                                                                                                                                                                        MD5:0FFC071BC5AF33D2BE224CF147670471
                                                                                                                                                                                                                        SHA1:5A7FC912A47D0531B2C95BFCB6BEAAA2248E0779
                                                                                                                                                                                                                        SHA-256:1923EFD4718E21B882410106B6FEF7FA35C3EB2EC3C2338CD8DFF07108F25C1F
                                                                                                                                                                                                                        SHA-512:205AF4B98312AB012BE7D7C25AC0A6D91D11C77DC3E29A9D6CC80F96A97577826079469AF16F88FE214CF0A17C70261C4AAA671FBB19EF214B91776BC3683353
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_cursor_icon.svg
                                                                                                                                                                                                                        Preview:<svg width="107" height="109" viewBox="0 0 107 109" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_286)"><path d="M78.856 41.614c.048-.048.096-.048.096-.096.048-.048.048-.096.048-.143v-.192c0-.096-.048-.144-.096-.24a.84.84 0 00-.191-.239c-.048-.096-.144-.143-.24-.191-.096-.048-.191-.144-.287-.192L31.16 17.144c-.096-.048-.144-.048-.24-.096S30.777 17 30.68 17h-.574c-.096 0-.144.048-.191.096-.048.048-.096.048-.144.096-.048.047-.048.095-.096.143L28 23.8v.191l7.853 43.29c0 .144.048.24.144.336.048.096.144.191.24.287.095.096.191.192.335.24.096.047.24.143.383.143.048 0 .048 0 .096.048h.622s.048 0 .048-.048c0 0 .048 0 .048-.048h.048s.048 0 .048-.047h.048l.048-.048.047-.048 10.153-14.27L63.1 70.537l.048.048s.048 0 .048.048l.048.048s.048.048.096.048h.096c.047 0 .047.047.095.047s.048.048.096.048h.863c.048 0 .048 0 .096-.047.048 0 .048-.048.096-.048l8.476-5.986 4.214-5.603c.048-.048.048-.096.096-.144 0-.048.047-.096.047-.144v-.191c0-.048-.047-.144-.047-.192a.363.363 0

                                                                                                                                                                                                                        Chrome Cache Entry: 283

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:HTML document, ASCII text, with very long lines (22120), with no line terminators
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                        Entropy (8bit):5.549206258636972
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:384:yodgYS8mFO+08LnFl+L8r8XFT+l+FFM0/508grFeLFkjFqmFR7F8uFK1FfNF4NFN:tMPXLFQY41aQbD/q8oFWFYFTFZFlFsFo
                                                                                                                                                                                                                        MD5:6600EC14BEA9C4A13B4AF33127BB5B55
                                                                                                                                                                                                                        SHA1:F53295213A32EC0F8ED1B0C51AE2489DEF446517
                                                                                                                                                                                                                        SHA-256:86A52482675126776B1EE8F8CAA278D11FD58535A3EB6693279870DBCC1B7EE7
                                                                                                                                                                                                                        SHA-512:3565A50289CBE12DD6B0E01128397372C26630BE4D2765736A303853995EFB65A40C85F6584CB17589141918AB06462D397F521D3AF336480B3993F4A152C6ED
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://td.doubleclick.net/td/rul/858128210?random=1730914671161&cv=11&fst=1730914671161&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730911513052455%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1768241791.1730914671&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
                                                                                                                                                                                                                        Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":5184000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s1768241791.1730914671","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s1768241791.1730914671\u0026ig_key=1sNHMxNzY4MjQxNzkxLjE3MzA5MTQ2NzE!2sZ3rDcQ!3sAAptDV7YFHB6","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sBY-Mzw!2sZ3rDcQ!3sAAptDV7YFHB6"],"userBiddingSignals":[["596093288","7904283812","7900466892","475816165","7904705661","7896384790"],null,1730914673525724],"ads":[{"renderUrl":"https://tdsf.doublecli

                                                                                                                                                                                                                        Chrome Cache Entry: 284

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (4952), with no line terminators
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):4952
                                                                                                                                                                                                                        Entropy (8bit):5.854370598721175
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:1gWUfvlcY021mvn1blhad7OIJoodnbUp2dEjkRUNcaJJ9CIG:1DY0hf1bT47OIqWb1ecaJJ9LG
                                                                                                                                                                                                                        MD5:EEACDD1F8457272368790924524FF9B4
                                                                                                                                                                                                                        SHA1:59BF8011A724228DB43719EA2E90B38C90D60F16
                                                                                                                                                                                                                        SHA-256:2472623954D33074F090E2AECB0BFB67504BBB14BA2AACE68BDB0AAE84506EFE
                                                                                                                                                                                                                        SHA-512:B53854433827CC2B6FE528D74B3FDD898E963A7C8551601AE2B13431E56AC18811B558577E51AEC3C4091C8BDB37B434CDF6FE7CABF6F2A5C99EA60E9DE91C88
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730914671204&cv=11&fst=1730914671204&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730911513052455%26_winver%3D19045%26version%3Dfa.1092c&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=1768241791.1730914671&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion&rfmt=3&fmt=4
                                                                                                                                                                                                                        Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                        Chrome Cache Entry: 285

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:HTML document, ASCII text, with very long lines (22134), with no line terminators
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):22134
                                                                                                                                                                                                                        Entropy (8bit):5.549707884327616
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:384:yXdgx38mFl+L8XFT+l8Ln8rFO+0+FFM0FU08grc+LcgjcGmct7c8ucB1cQNc1NcY:OMQY1amL8RPhbDFb8oc2c0c/cNclcHc5
                                                                                                                                                                                                                        MD5:AD8A7C0C4546443BAA59C9327CC465C0
                                                                                                                                                                                                                        SHA1:CCF87BB04BCF9B2A3AD57FD92DAB8D22B922898F
                                                                                                                                                                                                                        SHA-256:66D443DC5899E1B638D8BE5EA74A504C03FF52293FA5583A585937F8948BC66E
                                                                                                                                                                                                                        SHA-512:059757A7AA9752B4FE7A3BA8937377B428867B150EAA43FADF0B8D62D716622CE8981F243D2B05A51DD6D875FCF4BB5149590E16816F0A3A1F096BD2A8840709
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://td.doubleclick.net/td/rul/858128210?random=1730914671204&cv=11&fst=1730914671204&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730911513052455%26_winver%3D19045%26version%3Dfa.1092c&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=1768241791.1730914671&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion
                                                                                                                                                                                                                        Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":31104000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s1768241791.1730914671","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s1768241791.1730914671\u0026ig_key=1sNHMxNzY4MjQxNzkxLjE3MzA5MTQ2NzE!2saQZFcQ!3sAAptDV7ohxXb","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sBY-Mzw!2saQZFcQ!3sAAptDV7ohxXb"],"userBiddingSignals":[["7900466892","7896384790","7904705661","475816165","596093288","7904283812","8552333481"],null,1730914673536319],"ads":[{"renderUrl":"https://

                                                                                                                                                                                                                        Chrome Cache Entry: 286

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (3969)
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):290589
                                                                                                                                                                                                                        Entropy (8bit):5.559591167822972
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3072:4awizDGLET7do+hn0x5mptcY0/H8+ARrrOS2WrDm6DcM8rT/7jV:lGLg7doXczRiSR9cM8rT/7p
                                                                                                                                                                                                                        MD5:35F0CD0BCBCBF71F86BBF7AAE845846E
                                                                                                                                                                                                                        SHA1:FA87DA80EEE8EABE5D585188FA75925BAA3199F5
                                                                                                                                                                                                                        SHA-256:673F7C0808996FBC82ACB1FE392611CF9DF598DE2309F1CEDEEEA46A43168258
                                                                                                                                                                                                                        SHA-512:A202C9B455212E6FA1ACEB5E0ADE165B610C4A5815509BFC9FB22EED251D05AA29E996AAB9E6C43F5B455013A00E14CFE4AF2513292950DCBCF0F0FEFC96C288
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-858128210","tag_id":16},{"function":"__ogt_cps","priority":6,"vtp_cpsMode":"ALL","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_

                                                                                                                                                                                                                        Chrome Cache Entry: 287

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (3969)
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):290589
                                                                                                                                                                                                                        Entropy (8bit):5.559591167822972
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:3072:4awizDGLET7do+hn0x5mptcY0/H8+ARrrOS2WrDm6DcM8rT/7jV:lGLg7doXczRiSR9cM8rT/7p
                                                                                                                                                                                                                        MD5:35F0CD0BCBCBF71F86BBF7AAE845846E
                                                                                                                                                                                                                        SHA1:FA87DA80EEE8EABE5D585188FA75925BAA3199F5
                                                                                                                                                                                                                        SHA-256:673F7C0808996FBC82ACB1FE392611CF9DF598DE2309F1CEDEEEA46A43168258
                                                                                                                                                                                                                        SHA-512:A202C9B455212E6FA1ACEB5E0ADE165B610C4A5815509BFC9FB22EED251D05AA29E996AAB9E6C43F5B455013A00E14CFE4AF2513292950DCBCF0F0FEFC96C288
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://www.googletagmanager.com/gtag/js?id=AW-858128210
                                                                                                                                                                                                                        Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-858128210","tag_id":16},{"function":"__ogt_cps","priority":6,"vtp_cpsMode":"ALL","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_

                                                                                                                                                                                                                        Chrome Cache Entry: 288

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):3592
                                                                                                                                                                                                                        Entropy (8bit):4.71780114350715
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:XlbKIGVo4FFr2s2wVix2FFCCQ86TqYeZEB:XVFCXc+ixi4lTPB
                                                                                                                                                                                                                        MD5:0FFC071BC5AF33D2BE224CF147670471
                                                                                                                                                                                                                        SHA1:5A7FC912A47D0531B2C95BFCB6BEAAA2248E0779
                                                                                                                                                                                                                        SHA-256:1923EFD4718E21B882410106B6FEF7FA35C3EB2EC3C2338CD8DFF07108F25C1F
                                                                                                                                                                                                                        SHA-512:205AF4B98312AB012BE7D7C25AC0A6D91D11C77DC3E29A9D6CC80F96A97577826079469AF16F88FE214CF0A17C70261C4AAA671FBB19EF214B91776BC3683353
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="107" height="109" viewBox="0 0 107 109" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_286)"><path d="M78.856 41.614c.048-.048.096-.048.096-.096.048-.048.048-.096.048-.143v-.192c0-.096-.048-.144-.096-.24a.84.84 0 00-.191-.239c-.048-.096-.144-.143-.24-.191-.096-.048-.191-.144-.287-.192L31.16 17.144c-.096-.048-.144-.048-.24-.096S30.777 17 30.68 17h-.574c-.096 0-.144.048-.191.096-.048.048-.096.048-.144.096-.048.047-.048.095-.096.143L28 23.8v.191l7.853 43.29c0 .144.048.24.144.336.048.096.144.191.24.287.095.096.191.192.335.24.096.047.24.143.383.143.048 0 .048 0 .096.048h.622s.048 0 .048-.048c0 0 .048 0 .048-.048h.048s.048 0 .048-.047h.048l.048-.048.047-.048 10.153-14.27L63.1 70.537l.048.048s.048 0 .048.048l.048.048s.048.048.096.048h.096c.047 0 .047.047.095.047s.048.048.096.048h.863c.048 0 .048 0 .096-.047.048 0 .048-.048.096-.048l8.476-5.986 4.214-5.603c.048-.048.048-.096.096-.144 0-.048.047-.096.047-.144v-.191c0-.048-.047-.144-.047-.192a.363.363 0

                                                                                                                                                                                                                        Chrome Cache Entry: 289

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:HTML document, ASCII text, with very long lines (22120), with no line terminators
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):22120
                                                                                                                                                                                                                        Entropy (8bit):5.549310102772744
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:384:yodgYV8rFT+l8LnFl+L8X8mFM+F+0FO0/50cEr8hL89Cj8tm8078Nu8A18IN8HN7:CRamLFQYsM5wKZ/qcU818k8I8c888C8/
                                                                                                                                                                                                                        MD5:A2066BE52577BF044F0233CEF61CB387
                                                                                                                                                                                                                        SHA1:4C53B7149816BE4C1460BC2F7028157BE2E3A29C
                                                                                                                                                                                                                        SHA-256:017BBD6A5C6329A6ED234DF96E230A336A3EED4642404155C63C8BF5B337C508
                                                                                                                                                                                                                        SHA-512:A2F656F2C3900B72E79FE853E1CA3D2672467B2281C77BEAA89496A94617F42E122638E8BA6542630B1F1039135B538ADDEA03B45DAC60905888F276E4C69F56
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://td.doubleclick.net/td/rul/858128210?random=1730914671189&cv=11&fst=1730914671189&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730911513052455%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1768241791.1730914671&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view
                                                                                                                                                                                                                        Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":5184000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s1768241791.1730914671","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s1768241791.1730914671\u0026ig_key=1sNHMxNzY4MjQxNzkxLjE3MzA5MTQ2NzE!2sZ3rDcQ!3sAAptDV7YFHB6","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sBY-Mzw!2sZ3rDcQ!3sAAptDV7YFHB6"],"userBiddingSignals":[["475816165","7896384790","7904705661","596093288","7904283812","7900466892"],null,1730914673534370],"ads":[{"renderUrl":"https://tdsf.doublecli

                                                                                                                                                                                                                        Chrome Cache Entry: 290

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):438985
                                                                                                                                                                                                                        Entropy (8bit):5.626422620194972
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:N4wGTFhCGLgB40oNUzWRSR9cM8rT/x2+YUZ9Or24Avp:GwiFhjc40oNOWYmYw
                                                                                                                                                                                                                        MD5:DF497B0356B63A71950A64CDC85BE5D7
                                                                                                                                                                                                                        SHA1:E7BE9FECA56E68E38764A05851F812D5FC5AEC9D
                                                                                                                                                                                                                        SHA-256:8CE638B4C0CC13279123D790FEBE062D2FEC7B01F2F5D72EA9E3862B03ACD4F9
                                                                                                                                                                                                                        SHA-512:3AA29F5E6D439EE7A9BF491DF48573C2959193EA812F570805CC37939BE8C9CC2C10C6A780852659A55ABEFAD1F5B175B07244B4699F02A6DAFAFD33524D00D3
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C&l=dataLayer&cx=c
                                                                                                                                                                                                                        Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                                                        Chrome Cache Entry: 291

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (4970), with no line terminators
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):4970
                                                                                                                                                                                                                        Entropy (8bit):5.857439818768712
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:1gWUfvlcY021mvn1blhad7OIJoodnbUp2dEjkRUNcaJJ9CIlT:1DY0hf1bT47OIqWb1ecaJJ9LlT
                                                                                                                                                                                                                        MD5:936A83DF0EB8A6527726988D8BA12059
                                                                                                                                                                                                                        SHA1:C972A84E3AE0650DF6A5F3671B6965A69FCB22D5
                                                                                                                                                                                                                        SHA-256:5436D80E2A3C6F6972B0042F3425828081414A3BC90B55851C563C9099BED62C
                                                                                                                                                                                                                        SHA-512:DF66A84066838BCD23D0AA10102D51623E16BCAB54E942A7AE14B5653FCFD28695FD2890F880A7EF9C95AAC41D22C5ACB1C83965E0E9C3D5DD8342553BB81812
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                        Chrome Cache Entry: 292

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:Web Open Font Format (Version 2), TrueType, length 48444, version 1.0
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):48444
                                                                                                                                                                                                                        Entropy (8bit):7.995593685409469
                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                        SSDEEP:768:dn0V9qZpy/4pR+9MzTCGXckDohHxCc/TfZQEh9UONYyPYcABoN/8rZujvB:dn0+rAmWUMooVrbZQE7NYyzABK8rQ1
                                                                                                                                                                                                                        MD5:8E433C0592F77BEB6DC527D7B90BE120
                                                                                                                                                                                                                        SHA1:D7402416753AE1BB4CBD4B10D33A0C10517838BD
                                                                                                                                                                                                                        SHA-256:F052EE44C3728DFD23ABA8A4567150BC314D23903026FBB6AD089422C2DF56AF
                                                                                                                                                                                                                        SHA-512:5E90F48B923BB95AEB49691D03DADE8825C119B2FA28977EA170C41548900F4E0165E2869F97C7A9380D7FF8FF331A1DA855500E5F7B0DFD2B9ABD77A386BBF3
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
                                                                                                                                                                                                                        Preview:wOF2.......<.......l..............................`...\..p?HVAR.m?MVAR^.`?STAT.N'&..>/l........>....0....6.$.... ........[..A.2v.6......$..e...w"../.L.p:......Tpc..8@.[5......d#d.xw..o.O3-.....%..>...%..)~p.K.J.H..S...s..z..Wa.. 0\..J.....BL;V..-.L...j....^.9..HO l..,.*.6.v....?....x.....m..;....a![zif...Ur...Q..P.&.I1..:n.p...j~..h...9.!....@.<.bl|.Y?h..B.j/..rH.S%/~.^D...6..D.4G...y....Y.....=/o..W..5ryo.d?.gA]..?...1V..S......7ZJ...f....mBG[0eW....y..%B}..]? ...,sR<.y~.~.}.%.!..,X.....`...R..^....S.....u*.?k.v.k..U.u..M..`!...b!..X)P...y{.........n..T+6...R......L...x}...g...].g"WT.b..h ....X...=;{w...QO.s..w..@.(,..........{.........1..@...(...\.......9*..2.h9P.G........K.Dp...F..4W..ui.u...G...s..x7.?..tg..D..O.sA..t.t.4..~..e\...X.....T..kf.qfX..=^_....g"....De...x[J..A..).G.YUhR.....0.l..#&3.'.K..*...........$I.Pp.../.s.<@...r=..S......d..P.S.B.w.~X..ZK....h J.`A.bv,=.....>1.Ev.^..U.A. ....EU..].........dw..!$.A`..B.._.....Z~..!..J..l]r.m}m..

                                                                                                                                                                                                                        Chrome Cache Entry: 293

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):2118
                                                                                                                                                                                                                        Entropy (8bit):4.907323279161229
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:P8LlLU20REEalwVtWMhiiA379OC0WGKwKNHOLRcVIK0:ULtU2A8lwVtW+3ALKczI5
                                                                                                                                                                                                                        MD5:1039640CF0666A1621D55C9E9FA81439
                                                                                                                                                                                                                        SHA1:A7E6A6AB233DAE1776506F2E6C7FD03E46E83EA9
                                                                                                                                                                                                                        SHA-256:4455C2A26901C4D348E194B06B06908C155E6459CF5987984D03848E30964F0C
                                                                                                                                                                                                                        SHA-512:F9324B6C58C51DC3F24BD242EADA7E5565B60E12863EC13F28D883028791AEC7EC5E324298FA0427AD1CD45BDD7260FF0295DC171F24DD0AC3F0203FB6CD0706
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:<svg width="132" height="132" viewBox="0 0 132 132" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_279)"><path d="M16 12.5A4.5 4.5 0 0120.5 8h91a4.5 4.5 0 014.5 4.5v91a4.5 4.5 0 01-4.5 4.5h-91a4.5 4.5 0 01-4.5-4.5v-91z" fill="#fff"/></g><path d="M81.894 54.233H67.64c-.913 0-.913 0-.913-.865V32.733c0-.865 0-.845.85-.966 3.341-.463 6.661-.946 10.002-1.41 3.839-.543 7.657-1.066 11.496-1.59 2.345-.322 4.69-.664 7.014-.986 1.037-.14 1.037-.14 1.037.866v24.6c0 .986 0 .986-1.016.986H81.894zm.021 5.841h14.422c.767 0 .767 0 .767.765v24.963c0 .845 0 .865-.871.745-3.32-.463-6.64-.947-9.94-1.41-2.282-.322-4.586-.624-6.868-.946-2.801-.382-5.603-.785-8.404-1.187-1.204-.161-2.386-.363-3.59-.484-.54-.06-.705-.261-.705-.764.02-4.067.02-8.113.02-12.18v-8.898c0-.463.146-.604.623-.604 4.814.02 9.69 0 14.546 0zm-34.175.001h12.243c.705 0 .705 0 .705.704v19.669c0 .825-.041.825-.892.704-2.47-.342-4.918-.684-7.387-1.026-2.158-.303-4.316-.625-6.454-.927-2.448-.342-4.897-.664-7.345-

                                                                                                                                                                                                                        Chrome Cache Entry: 294

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (4851), with no line terminators
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):4851
                                                                                                                                                                                                                        Entropy (8bit):5.838758329056139
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:1gWUfvlcY021mvn1blhad7OIJoodnbUp2dEjkRUNJb9CY:1DY0hf1bT47OIqWb1wJb9t
                                                                                                                                                                                                                        MD5:C7821A7AC3574F69285C542029B8C415
                                                                                                                                                                                                                        SHA1:65653B4CAC8C8E3D4A3904612E2069D38FC8C6CA
                                                                                                                                                                                                                        SHA-256:FDAD67BB71BEC26349B43A3B57D640915EF807DA9470B3491A8860825A343349
                                                                                                                                                                                                                        SHA-512:EA1D61D40B8FF88C6BC2BD22869A6F3B8E711AF1D6625C1582495B77EDFD4394080D9B5C5CCC81EAE1B75665B94995ED5B12DCE9BB7CB6EC6A8B58F92C75468F
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730914671189&cv=11&fst=1730914671189&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730911513052455%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1768241791.1730914671&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4
                                                                                                                                                                                                                        Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                        Chrome Cache Entry: 295

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (4873), with no line terminators
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):4873
                                                                                                                                                                                                                        Entropy (8bit):5.844092498536716
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:1gWUfvlcY021mvn1blhad7OIJoodnbUp2dEjkRUYJx9C7:1DY0hf1bT47OIqWb1xJx9+
                                                                                                                                                                                                                        MD5:763D4E50030434221D46A3ECA88FBC59
                                                                                                                                                                                                                        SHA1:1797B02A4950D03DF2AC2D60D3BE52439EFB26C8
                                                                                                                                                                                                                        SHA-256:413AD0559BED5B2785B2D793C7A023384323BF608C8C6B4D2187A792DB7C0E5E
                                                                                                                                                                                                                        SHA-512:9781C01D7052D3E32FC8FAB089B232D01F7D0398F05EBE3598BB0F09457649E38584E30575FBCCA6C9D55EAFF2CC4190F0605DC82E93BDD5801CF10036F06984
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                        Chrome Cache Entry: 296

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):2499
                                                                                                                                                                                                                        Entropy (8bit):5.4636477793325495
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:ejO4aAujO4aFuFZjjO4aNjO4a73rjO4awNjO4aQJc+uXjO4aWN0xD:aO4aAqO4aEFZHO4adO4a73vO4aoO4aQt
                                                                                                                                                                                                                        MD5:382991778933FB8F5697DEB2EE26A0ED
                                                                                                                                                                                                                        SHA1:6CDED0C76F01EA3C3C6DB8128B5CF59063A92C78
                                                                                                                                                                                                                        SHA-256:0919FF36779EEF85FA50AF4B94FB2D496A765612B7C5EDD31BA69EA1F4136736
                                                                                                                                                                                                                        SHA-512:FC05BAFD9EB747B7060B8C730E8A467CFD0A0311622B325E5EB74A1083D3A7B8897396CF4FE310E7567EAA1B5A951AB3906F57E57671F2852A18ED1AD0E7E2C9
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://fonts.googleapis.com/css2?family=Inter:wght@100..900&display=swap
                                                                                                                                                                                                                        Preview:/* cyrillic-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2JL7SUc.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2ZL7SUc.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. f

                                                                                                                                                                                                                        Chrome Cache Entry: 297

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:HTML document, ASCII text, with very long lines (815)
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):3501
                                                                                                                                                                                                                        Entropy (8bit):5.383873370647921
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:EI5cZUiKliCJ86U+QTEVWfeLwTauSEegdkZ5edOIC:EI5hiWNJ8kQTEVWfeUauRfdkZ5edO1
                                                                                                                                                                                                                        MD5:147FD3B00C22BA9C939712E9213C24CA
                                                                                                                                                                                                                        SHA1:3B48369B86FA0574F35379AACD1F42CC9C98A52B
                                                                                                                                                                                                                        SHA-256:70F5B11C1870CF90201A6D5F770CA318A3FA5827C74A8765EDE22B487F7D4532
                                                                                                                                                                                                                        SHA-512:E8419A71232EDAC8FD131446777F7D034B3171EFE07B3267479B439E4982650DB65A0D1DDC9F516315D5ED1B01ECFD2F7EB55D75D44AA51EE0AD494D441586D2
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fpcapp.store
                                                                                                                                                                                                                        Preview:<!DOCTYPE html>.<html>.<head>. <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">.</head>.<body>. <script>.'use strict';class m{constructor(a){this.j=a;this.g={};this.h={};this.i=0;this.id=String(Math.floor(Number.MAX_SAFE_INTEGER*Math.random()))}}function n(a){return a.performance&&a.performance.now()||Date.now()}.var p=function(a,b){class d{constructor(c,g,f){this.failureType=c;this.data=g;this.g=f;this.h=new m(n(f))}s(c,g){const f=c.clientId;if(c.type===0){c.isDead=!0;var e=this.h,h=n(this.g);e.g[f]==null&&(e.g[f]=0,e.h[f]=h,e.i++);e.g[f]++;c.stats={targetId:e.id,clientCount:e.i,totalLifeMs:Math.round(h-e.j),heartbeatCount:e.g[f],clientLifeMs:Math.round(h-e.h[f])}}c.failure={failureType:this.failureType,data:this.data};g(c)}}return new d(5,a,b)};/*.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/.let q=globalThis.trustedTypes,r;function t(){let a=null;if(!q)return a;try{const b=d=>d;a=q.createPolicy("goog#html",{createHTML:b,createScript:b,crea

                                                                                                                                                                                                                        Chrome Cache Entry: 298

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (4855), with no line terminators
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):4855
                                                                                                                                                                                                                        Entropy (8bit):5.838509901256264
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:96:1gWUfvlcY021mvn1blhad7OIJoodnbUp2dEjkRUYJx9C6:1DY0hf1bT47OIqWb1xJx9P
                                                                                                                                                                                                                        MD5:BD8D09A7BD4E045E80CA59D9313A89C2
                                                                                                                                                                                                                        SHA1:1BA9ED5FAE373D74D851819DA722FE7A9E7AAB51
                                                                                                                                                                                                                        SHA-256:CC3848A730B8B3F765D67F968FA1424F7FBEBA170D83C01D4E7BB800C77CA998
                                                                                                                                                                                                                        SHA-512:818C198BE47CBDB2AB82F65230792ED1338DC287966D041550C7B2DC41AFF1FE9943EC05A64BDEB6426A0DB93BDD757DFFC7ABBFFC8DA28BC7C7D93022E1047F
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730914671161&cv=11&fst=1730914671161&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730911513052455%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=1768241791.1730914671&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
                                                                                                                                                                                                                        Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                        Chrome Cache Entry: 299

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                        Size (bytes):438959
                                                                                                                                                                                                                        Entropy (8bit):5.6265770476944015
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:6144:N4wGTFhCGLgB4doXUzWRSR9cM8rT/o2+YUZ9Or24Avd:GwiFhjc4doXOHYmYw
                                                                                                                                                                                                                        MD5:BF7214766D0D9379CEC1082BCC031CFC
                                                                                                                                                                                                                        SHA1:CC23DA1A602AF6148ED8223EB9F533D44D31703A
                                                                                                                                                                                                                        SHA-256:78230792258A55D665803192726757E0ECF068524D29F5C0B3F79A0B29D1CA09
                                                                                                                                                                                                                        SHA-512:67098CCF6ABD2D661682FA738F23BE7F256B41E135BA10067F645386B8B46DC09962C0AD55B3838273D5C3C45C1708530D77F1D64144D42D2BA102EDF183087D
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                                                        Chrome Cache Entry: 300

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (723)
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):7076
                                                                                                                                                                                                                        Entropy (8bit):5.52488676121649
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:192:bttd4a6O1T6ahNU3dJ+SrM0hjUYIW2WX8ISlY:bBJ1T9UNJ+SrM0lXV2WXXSlY
                                                                                                                                                                                                                        MD5:88A2E0A522036C0B87E03552E56629AA
                                                                                                                                                                                                                        SHA1:EC9D1157518E753A84DBDE1333A29B34CF776D63
                                                                                                                                                                                                                        SHA-256:788AFB96F2DA68E8729EC35F3D5E381FAD3482D37C54C2195C7311440EE4C27E
                                                                                                                                                                                                                        SHA-512:44B953878BD650FE2BCC8B6904620955C3E396B7DC8F41F85D021A8E0404DA41DB15C5499A03F7D4FE9129BB340AA3F6782942CF5327502FD4569BEBBB17073F
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.store
                                                                                                                                                                                                                        Preview:'use strict';var k=function(a){function b(c){return a.next(c)}function e(c){return a.throw(c)}return new Promise(function(c,d){function f(h){h.done?c(h.value):Promise.resolve(h.value).then(b,e).then(f,d)}f(a.next())})};/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var m=this||self;var u,v;a:{for(var x=["CLOSURE_FLAGS"],B=m,C=0;C<x.length;C++)if(B=B[x[C]],B==null){v=null;break a}v=B}var G=v&&v[610401301];u=G!=null?G:!1;var H;const I=m.navigator;H=I?I.userAgentData||null:null;function J(a){return u?H?H.brands.some(({brand:b})=>b&&b.indexOf(a)!=-1):!1:!1}function K(a){var b;a:{const e=m.navigator;if(e){const c=e.userAgent;if(c){b=c;break a}}b=""}return b.indexOf(a)!=-1};function L(){return u?!!H&&H.brands.length>0:!1}function O(){return L()?J("Chromium"):(K("Chrome")||K("CriOS"))&&!(L()?0:K("Edge"))||K("Silk")};!K("Android")||O();O();!K("Safari")||O()||(L()?0:K("Coast"))||(L()?0:K("Opera"))||(L()?0:K("Edge"))||(L()?J("Microsoft Edge"):K("Edg/"))||L()&

                                                                                                                                                                                                                        Chrome Cache Entry: 301

                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                        Category:downloaded
                                                                                                                                                                                                                        Size (bytes):2118
                                                                                                                                                                                                                        Entropy (8bit):4.907323279161229
                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                        SSDEEP:48:P8LlLU20REEalwVtWMhiiA379OC0WGKwKNHOLRcVIK0:ULtU2A8lwVtW+3ALKczI5
                                                                                                                                                                                                                        MD5:1039640CF0666A1621D55C9E9FA81439
                                                                                                                                                                                                                        SHA1:A7E6A6AB233DAE1776506F2E6C7FD03E46E83EA9
                                                                                                                                                                                                                        SHA-256:4455C2A26901C4D348E194B06B06908C155E6459CF5987984D03848E30964F0C
                                                                                                                                                                                                                        SHA-512:F9324B6C58C51DC3F24BD242EADA7E5565B60E12863EC13F28D883028791AEC7EC5E324298FA0427AD1CD45BDD7260FF0295DC171F24DD0AC3F0203FB6CD0706
                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                        URL:https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_windows_icon.svg
                                                                                                                                                                                                                        Preview:<svg width="132" height="132" viewBox="0 0 132 132" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_279)"><path d="M16 12.5A4.5 4.5 0 0120.5 8h91a4.5 4.5 0 014.5 4.5v91a4.5 4.5 0 01-4.5 4.5h-91a4.5 4.5 0 01-4.5-4.5v-91z" fill="#fff"/></g><path d="M81.894 54.233H67.64c-.913 0-.913 0-.913-.865V32.733c0-.865 0-.845.85-.966 3.341-.463 6.661-.946 10.002-1.41 3.839-.543 7.657-1.066 11.496-1.59 2.345-.322 4.69-.664 7.014-.986 1.037-.14 1.037-.14 1.037.866v24.6c0 .986 0 .986-1.016.986H81.894zm.021 5.841h14.422c.767 0 .767 0 .767.765v24.963c0 .845 0 .865-.871.745-3.32-.463-6.64-.947-9.94-1.41-2.282-.322-4.586-.624-6.868-.946-2.801-.382-5.603-.785-8.404-1.187-1.204-.161-2.386-.363-3.59-.484-.54-.06-.705-.261-.705-.764.02-4.067.02-8.113.02-12.18v-8.898c0-.463.146-.604.623-.604 4.814.02 9.69 0 14.546 0zm-34.175.001h12.243c.705 0 .705 0 .705.704v19.669c0 .825-.041.825-.892.704-2.47-.342-4.918-.684-7.387-1.026-2.158-.303-4.316-.625-6.454-.927-2.448-.342-4.897-.664-7.345-

                                                                                                                                                                                                                        Static File Info

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                        Entropy (8bit):7.612745424395439
                                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                        File name:Setup.exe
                                                                                                                                                                                                                        File size:190'056 bytes
                                                                                                                                                                                                                        MD5:5df7ccb72d4007e7fae710495b42de76
                                                                                                                                                                                                                        SHA1:0e38df6c075e5de92be6b99249d236089dac8d5b
                                                                                                                                                                                                                        SHA256:6c3e4398e3d563746b928bf359468f6baf416bf3f757ca789cdf7fab1f02a1b7
                                                                                                                                                                                                                        SHA512:5354d678e7fe2b777b847d1614fb7de05fa32025d4a4b616c68b985b64129f12c1d84769404ff72380340c4b8c61b7fda58ba109aa8cddbbdb7ce108141dd449
                                                                                                                                                                                                                        SSDEEP:3072:UbG7N2kDTHUpouL4Ynd86Pzy5n+/mGCK8izuG2okB2h4l591BBgkXmUa:UbE/HUzRe6ry5nmQiiGz4z9TJXra
                                                                                                                                                                                                                        TLSH:7004F15056E0C862D8A28B71B5797F7B8AB5DC2192B04F8313107B187E7DE819F0E3A3
                                                                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j.........

                                                                                                                                                                                                                        File Icon

                                                                                                                                                                                                                        Icon Hash:45d44c7192498005

                                                                                                                                                                                                                        Static PE Info

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Entrypoint:0x40352d
                                                                                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                                                                                        Digitally signed:true
                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                        Time Stamp:0x614F9B5A [Sat Sep 25 21:57:46 2021 UTC]
                                                                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                                        OS Version Major:4
                                                                                                                                                                                                                        OS Version Minor:0
                                                                                                                                                                                                                        File Version Major:4
                                                                                                                                                                                                                        File Version Minor:0
                                                                                                                                                                                                                        Subsystem Version Major:4
                                                                                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                                                                                        Import Hash:56a78d55f3f7af51443e58e0ce2fb5f6

                                                                                                                                                                                                                        Authenticode Signature

                                                                                                                                                                                                                        Signature Valid:true
                                                                                                                                                                                                                        Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                                                                                                                                                        Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                        Error Number:0
                                                                                                                                                                                                                        Not Before, Not After
                                                                                                                                                                                                                        • 08/05/2024 01:00:00 13/02/2025 23:59:59
                                                                                                                                                                                                                        Subject Chain
                                                                                                                                                                                                                        • CN=FAST CORPORATION LTD, O=FAST CORPORATION LTD, L=Ra'anana, C=IL, SERIALNUMBER=515636181, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IL
                                                                                                                                                                                                                        Version:3
                                                                                                                                                                                                                        Thumbprint MD5:04786BD703B906E22AECB2AD38CE4D94
                                                                                                                                                                                                                        Thumbprint SHA-1:07BE42727905BE32C822A638502C1B8FAAE6540A
                                                                                                                                                                                                                        Thumbprint SHA-256:FDB017BB88E5D453E22A73810690C72534F58EFB109EA0D4494EC393F2307DBC
                                                                                                                                                                                                                        Serial:0E5C655E1CBE9A8879372F58A5BC0302

                                                                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                                        push ebp
                                                                                                                                                                                                                        mov ebp, esp
                                                                                                                                                                                                                        sub esp, 000003F4h
                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                        push edi
                                                                                                                                                                                                                        push 00000020h
                                                                                                                                                                                                                        pop edi
                                                                                                                                                                                                                        xor ebx, ebx
                                                                                                                                                                                                                        push 00008001h
                                                                                                                                                                                                                        mov dword ptr [ebp-14h], ebx
                                                                                                                                                                                                                        mov dword ptr [ebp-04h], 0040A2E0h
                                                                                                                                                                                                                        mov dword ptr [ebp-10h], ebx
                                                                                                                                                                                                                        call dword ptr [004080CCh]
                                                                                                                                                                                                                        mov esi, dword ptr [004080D0h]
                                                                                                                                                                                                                        lea eax, dword ptr [ebp-00000140h]
                                                                                                                                                                                                                        push eax
                                                                                                                                                                                                                        mov dword ptr [ebp-0000012Ch], ebx
                                                                                                                                                                                                                        mov dword ptr [ebp-2Ch], ebx
                                                                                                                                                                                                                        mov dword ptr [ebp-28h], ebx
                                                                                                                                                                                                                        mov dword ptr [ebp-00000140h], 0000011Ch
                                                                                                                                                                                                                        call esi
                                                                                                                                                                                                                        test eax, eax
                                                                                                                                                                                                                        jne 00007FA4D4C7E8FAh
                                                                                                                                                                                                                        lea eax, dword ptr [ebp-00000140h]
                                                                                                                                                                                                                        mov dword ptr [ebp-00000140h], 00000114h
                                                                                                                                                                                                                        push eax
                                                                                                                                                                                                                        call esi
                                                                                                                                                                                                                        mov ax, word ptr [ebp-0000012Ch]
                                                                                                                                                                                                                        mov ecx, dword ptr [ebp-00000112h]
                                                                                                                                                                                                                        sub ax, 00000053h
                                                                                                                                                                                                                        add ecx, FFFFFFD0h
                                                                                                                                                                                                                        neg ax
                                                                                                                                                                                                                        sbb eax, eax
                                                                                                                                                                                                                        mov byte ptr [ebp-26h], 00000004h
                                                                                                                                                                                                                        not eax
                                                                                                                                                                                                                        and eax, ecx
                                                                                                                                                                                                                        mov word ptr [ebp-2Ch], ax
                                                                                                                                                                                                                        cmp dword ptr [ebp-0000013Ch], 0Ah
                                                                                                                                                                                                                        jnc 00007FA4D4C7E8CAh
                                                                                                                                                                                                                        and word ptr [ebp-00000132h], 0000h
                                                                                                                                                                                                                        mov eax, dword ptr [ebp-00000134h]
                                                                                                                                                                                                                        movzx ecx, byte ptr [ebp-00000138h]
                                                                                                                                                                                                                        mov dword ptr [00434FB8h], eax
                                                                                                                                                                                                                        xor eax, eax
                                                                                                                                                                                                                        mov ah, byte ptr [ebp-0000013Ch]
                                                                                                                                                                                                                        movzx eax, ax
                                                                                                                                                                                                                        or eax, ecx
                                                                                                                                                                                                                        xor ecx, ecx
                                                                                                                                                                                                                        mov ch, byte ptr [ebp-2Ch]
                                                                                                                                                                                                                        movzx ecx, cx
                                                                                                                                                                                                                        shl eax, 10h
                                                                                                                                                                                                                        or eax, ecx

                                                                                                                                                                                                                        Rich Headers

                                                                                                                                                                                                                        Programming Language:
                                                                                                                                                                                                                        • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                                                                        Data Directories

                                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x6c0000x4f40.rsrc
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x2bd000x2968.data
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                        Sections

                                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                        .text0x10000x68970x6a00ce9df19df15aa7bfbc0a8d0af0b841d0False0.6661261792452831data6.458398214928006IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                        .rdata0x80000x14a60x1600a118375c929d970903c1204233b7583dFalse0.4392755681818182data5.024109281264143IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                        .data0xa0000x2b0180x60082a10c59a8679bb952fc8316070b8a6cFalse0.521484375data4.15458210408643IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                        .ndata0x360000x360000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                        .rsrc0x6c0000x4f400x50006147c56de0951034d77b52b0075b790fFalse0.1015625data2.760740823683962IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                        Resources

                                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                        RT_ICON0x6c2080x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2834 x 2834 px/mEnglishUnited States0.036372224846480866
                                                                                                                                                                                                                        RT_DIALOG0x704300x202dataEnglishUnited States0.4085603112840467
                                                                                                                                                                                                                        RT_DIALOG0x706380xf8dataEnglishUnited States0.6290322580645161
                                                                                                                                                                                                                        RT_DIALOG0x707300xa0dataEnglishUnited States0.60625
                                                                                                                                                                                                                        RT_DIALOG0x707d00xeedataEnglishUnited States0.6302521008403361
                                                                                                                                                                                                                        RT_GROUP_ICON0x708c00x14dataEnglishUnited States1.1
                                                                                                                                                                                                                        RT_VERSION0x708d80x240dataEnglishUnited States0.4895833333333333
                                                                                                                                                                                                                        RT_MANIFEST0x70b180x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

                                                                                                                                                                                                                        Imports

                                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                                        ADVAPI32.dllRegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
                                                                                                                                                                                                                        SHELL32.dllSHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
                                                                                                                                                                                                                        ole32.dllOleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
                                                                                                                                                                                                                        COMCTL32.dllImageList_Create, ImageList_Destroy, ImageList_AddMasked
                                                                                                                                                                                                                        USER32.dllGetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
                                                                                                                                                                                                                        GDI32.dllSetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
                                                                                                                                                                                                                        KERNEL32.dllGetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

                                                                                                                                                                                                                        Possible Origin

                                                                                                                                                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                        EnglishUnited States

                                                                                                                                                                                                                        Network Behavior

                                                                                                                                                                                                                        ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                                        Statistics

                                                                                                                                                                                                                        CPU Usage

                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                        Memory Usage

                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                                        Behavior

                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                        System Behavior

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:0
                                                                                                                                                                                                                        Start time:12:37:37
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\Setup.exe"
                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                        File size:190'056 bytes
                                                                                                                                                                                                                        MD5 hash:5DF7CCB72D4007E7FAE710495B42DE76
                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:1
                                                                                                                                                                                                                        Start time:12:37:44
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241106123744.238&_fcid=1730911513052455
                                                                                                                                                                                                                        Imagebase:0x7ff76e190000
                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:3
                                                                                                                                                                                                                        Start time:12:37:45
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2008,i,3825837893827184749,16738686684280894307,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                        Imagebase:0x7ff76e190000
                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:4
                                                                                                                                                                                                                        Start time:12:37:49
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4880 --field-trial-handle=2008,i,3825837893827184749,16738686684280894307,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                        Imagebase:0x7ff76e190000
                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:5
                                                                                                                                                                                                                        Start time:12:37:49
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=2008,i,3825837893827184749,16738686684280894307,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                        Imagebase:0x7ff76e190000
                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:9
                                                                                                                                                                                                                        Start time:12:38:06
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\nsb5A9.tmp
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\nsb5A9.tmp" /internal 1730911513052455 /force
                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                        File size:93'386'616 bytes
                                                                                                                                                                                                                        MD5 hash:84EE733F8014D22DAD2DFEF725489980
                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                        • Detection: 46%, ReversingLabs
                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:10
                                                                                                                                                                                                                        Start time:12:38:43
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Users\user\PCAppStore\PcAppStore.exe
                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                        Commandline:"C:\Users\user\PCAppStore\PcAppStore.exe" /init default
                                                                                                                                                                                                                        Imagebase:0x7ff660a80000
                                                                                                                                                                                                                        File size:3'116'888 bytes
                                                                                                                                                                                                                        MD5 hash:4B88D8ADA8D22622C30D581FC38EAA52
                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                        • Detection: 8%, ReversingLabs
                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:11
                                                                                                                                                                                                                        Start time:12:38:43
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                        Commandline:"C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241106123843.1985957453 /ver=fa.1092c
                                                                                                                                                                                                                        Imagebase:0x7ff724800000
                                                                                                                                                                                                                        File size:276'312 bytes
                                                                                                                                                                                                                        MD5 hash:11F3801CB9FF046D6075F681971C4EB8
                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                        • Detection: 5%, ReversingLabs
                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:12
                                                                                                                                                                                                                        Start time:12:38:43
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Windows\explorer.exe
                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                        Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                                                        Imagebase:0x7ff72b770000
                                                                                                                                                                                                                        File size:5'141'208 bytes
                                                                                                                                                                                                                        MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:14
                                                                                                                                                                                                                        Start time:12:38:51
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:16
                                                                                                                                                                                                                        Start time:12:38:52
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:17
                                                                                                                                                                                                                        Start time:12:38:52
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:18
                                                                                                                                                                                                                        Start time:12:38:52
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Users\user\PCAppStore\PcAppStore.exe
                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                        Commandline:"C:\Users\user\PCAppStore\PCAppStore.exe" /init default
                                                                                                                                                                                                                        Imagebase:0x7ff660a80000
                                                                                                                                                                                                                        File size:3'116'888 bytes
                                                                                                                                                                                                                        MD5 hash:4B88D8ADA8D22622C30D581FC38EAA52
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:19
                                                                                                                                                                                                                        Start time:12:38:53
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:20
                                                                                                                                                                                                                        Start time:12:38:53
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:21
                                                                                                                                                                                                                        Start time:12:38:53
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:23
                                                                                                                                                                                                                        Start time:12:38:54
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:24
                                                                                                                                                                                                                        Start time:12:38:55
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:25
                                                                                                                                                                                                                        Start time:12:38:55
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:26
                                                                                                                                                                                                                        Start time:12:38:55
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:27
                                                                                                                                                                                                                        Start time:12:38:55
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:28
                                                                                                                                                                                                                        Start time:12:38:56
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:29
                                                                                                                                                                                                                        Start time:12:38:56
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:30
                                                                                                                                                                                                                        Start time:12:38:56
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:31
                                                                                                                                                                                                                        Start time:12:38:57
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:32
                                                                                                                                                                                                                        Start time:12:38:57
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:33
                                                                                                                                                                                                                        Start time:12:38:57
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:34
                                                                                                                                                                                                                        Start time:12:38:57
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:35
                                                                                                                                                                                                                        Start time:12:38:57
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:36
                                                                                                                                                                                                                        Start time:12:38:57
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:37
                                                                                                                                                                                                                        Start time:12:38:58
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:38
                                                                                                                                                                                                                        Start time:12:38:58
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:39
                                                                                                                                                                                                                        Start time:12:38:58
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:40
                                                                                                                                                                                                                        Start time:12:38:58
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:41
                                                                                                                                                                                                                        Start time:12:38:59
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:42
                                                                                                                                                                                                                        Start time:12:38:59
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:43
                                                                                                                                                                                                                        Start time:12:39:00
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        General

                                                                                                                                                                                                                        Target ID:44
                                                                                                                                                                                                                        Start time:12:39:00
                                                                                                                                                                                                                        Start date:06/11/2024
                                                                                                                                                                                                                        Path:C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe
                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\IxQCuwJbcJgHRihUealEpGRKtQDEJoeWKmwvqkeNdPNauoRezzUPiruqrXuTjDZGFBlOYvDt\UywbCAwwkazz.exe"
                                                                                                                                                                                                                        Imagebase:0x6d0000
                                                                                                                                                                                                                        File size:140'800 bytes
                                                                                                                                                                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                        Disassembly

                                                                                                                                                                                                                        Reset < >

                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                          Execution Coverage:28.9%
                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                          Signature Coverage:16.6%
                                                                                                                                                                                                                          Total number of Nodes:1349
                                                                                                                                                                                                                          Total number of Limit Nodes:40
                                                                                                                                                                                                                          execution_graph 2924 4015c1 2943 402da6 2924->2943 2928 401631 2930 401663 2928->2930 2931 401636 2928->2931 2933 401423 24 API calls 2930->2933 2970 401423 2931->2970 2940 40165b 2933->2940 2938 40164a SetCurrentDirectoryW 2938->2940 2939 401617 GetFileAttributesW 2941 4015d1 2939->2941 2941->2928 2941->2939 2955 405e39 2941->2955 2959 405b08 2941->2959 2962 405a6e CreateDirectoryW 2941->2962 2967 405aeb CreateDirectoryW 2941->2967 2944 402db2 2943->2944 2974 40657a 2944->2974 2947 4015c8 2949 405eb7 CharNextW CharNextW 2947->2949 2950 405ed4 2949->2950 2954 405ee6 2949->2954 2951 405ee1 CharNextW 2950->2951 2950->2954 2952 405f0a 2951->2952 2952->2941 2953 405e39 CharNextW 2953->2954 2954->2952 2954->2953 2956 405e3f 2955->2956 2957 405e55 2956->2957 2958 405e46 CharNextW 2956->2958 2957->2941 2958->2956 3012 40690a GetModuleHandleA 2959->3012 2963 405abb 2962->2963 2964 405abf GetLastError 2962->2964 2963->2941 2964->2963 2965 405ace SetFileSecurityW 2964->2965 2965->2963 2966 405ae4 GetLastError 2965->2966 2966->2963 2968 405afb 2967->2968 2969 405aff GetLastError 2967->2969 2968->2941 2969->2968 3021 40559f 2970->3021 2973 40653d lstrcpynW 2973->2938 2978 406587 2974->2978 2975 4067aa 2976 402dd3 2975->2976 3007 40653d lstrcpynW 2975->3007 2976->2947 2991 4067c4 2976->2991 2978->2975 2979 406778 lstrlenW 2978->2979 2982 40657a 10 API calls 2978->2982 2983 40668f GetSystemDirectoryW 2978->2983 2985 4066a2 GetWindowsDirectoryW 2978->2985 2986 406719 lstrcatW 2978->2986 2987 40657a 10 API calls 2978->2987 2988 4067c4 5 API calls 2978->2988 2989 4066d1 SHGetSpecialFolderLocation 2978->2989 3000 40640b 2978->3000 3005 406484 wsprintfW 2978->3005 3006 40653d lstrcpynW 2978->3006 2979->2978 2982->2979 2983->2978 2985->2978 2986->2978 2987->2978 2988->2978 2989->2978 2990 4066e9 SHGetPathFromIDListW CoTaskMemFree 2989->2990 2990->2978 2997 4067d1 2991->2997 2992 406847 2993 40684c CharPrevW 2992->2993 2995 40686d 2992->2995 2993->2992 2994 40683a CharNextW 2994->2992 2994->2997 2995->2947 2996 405e39 CharNextW 2996->2997 2997->2992 2997->2994 2997->2996 2998 406826 CharNextW 2997->2998 2999 406835 CharNextW 2997->2999 2998->2997 2999->2994 3008 4063aa 3000->3008 3003 40646f 3003->2978 3004 40643f RegQueryValueExW RegCloseKey 3004->3003 3005->2978 3006->2978 3007->2976 3009 4063b9 3008->3009 3010 4063c2 RegOpenKeyExW 3009->3010 3011 4063bd 3009->3011 3010->3011 3011->3003 3011->3004 3013 406930 GetProcAddress 3012->3013 3014 406926 3012->3014 3016 405b0f 3013->3016 3018 40689a GetSystemDirectoryW 3014->3018 3016->2941 3017 40692c 3017->3013 3017->3016 3019 4068bc wsprintfW LoadLibraryExW 3018->3019 3019->3017 3022 4055ba 3021->3022 3023 401431 3021->3023 3024 4055d6 lstrlenW 3022->3024 3025 40657a 17 API calls 3022->3025 3023->2973 3026 4055e4 lstrlenW 3024->3026 3027 4055ff 3024->3027 3025->3024 3026->3023 3028 4055f6 lstrcatW 3026->3028 3029 405612 3027->3029 3030 405605 SetWindowTextW 3027->3030 3028->3027 3029->3023 3031 405618 SendMessageW SendMessageW SendMessageW 3029->3031 3030->3029 3031->3023 3032 401941 3033 401943 3032->3033 3034 402da6 17 API calls 3033->3034 3035 401948 3034->3035 3038 405c49 3035->3038 3074 405f14 3038->3074 3041 405c71 DeleteFileW 3072 401951 3041->3072 3042 405c88 3043 405da8 3042->3043 3088 40653d lstrcpynW 3042->3088 3043->3072 3106 406873 FindFirstFileW 3043->3106 3045 405cae 3046 405cc1 3045->3046 3047 405cb4 lstrcatW 3045->3047 3089 405e58 lstrlenW 3046->3089 3049 405cc7 3047->3049 3051 405cd7 lstrcatW 3049->3051 3053 405ce2 lstrlenW FindFirstFileW 3049->3053 3051->3053 3053->3043 3065 405d04 3053->3065 3056 405d8b FindNextFileW 3060 405da1 FindClose 3056->3060 3056->3065 3057 405c01 5 API calls 3059 405de3 3057->3059 3061 405de7 3059->3061 3062 405dfd 3059->3062 3060->3043 3066 40559f 24 API calls 3061->3066 3061->3072 3064 40559f 24 API calls 3062->3064 3064->3072 3065->3056 3067 405c49 60 API calls 3065->3067 3069 40559f 24 API calls 3065->3069 3071 40559f 24 API calls 3065->3071 3093 40653d lstrcpynW 3065->3093 3094 405c01 3065->3094 3102 4062fd MoveFileExW 3065->3102 3068 405df4 3066->3068 3067->3065 3070 4062fd 36 API calls 3068->3070 3069->3056 3070->3072 3071->3065 3112 40653d lstrcpynW 3074->3112 3076 405f25 3077 405eb7 4 API calls 3076->3077 3078 405f2b 3077->3078 3079 405c69 3078->3079 3080 4067c4 5 API calls 3078->3080 3079->3041 3079->3042 3086 405f3b 3080->3086 3081 405f6c lstrlenW 3082 405f77 3081->3082 3081->3086 3084 405e0c 3 API calls 3082->3084 3083 406873 2 API calls 3083->3086 3085 405f7c GetFileAttributesW 3084->3085 3085->3079 3086->3079 3086->3081 3086->3083 3087 405e58 2 API calls 3086->3087 3087->3081 3088->3045 3090 405e66 3089->3090 3091 405e78 3090->3091 3092 405e6c CharPrevW 3090->3092 3091->3049 3092->3090 3092->3091 3093->3065 3113 406008 GetFileAttributesW 3094->3113 3097 405c2e 3097->3065 3098 405c24 DeleteFileW 3100 405c2a 3098->3100 3099 405c1c RemoveDirectoryW 3099->3100 3100->3097 3101 405c3a SetFileAttributesW 3100->3101 3101->3097 3103 406311 3102->3103 3105 40631e 3102->3105 3116 406183 3103->3116 3105->3065 3107 405dcd 3106->3107 3108 406889 FindClose 3106->3108 3107->3072 3109 405e0c lstrlenW CharPrevW 3107->3109 3108->3107 3110 405dd7 3109->3110 3111 405e28 lstrcatW 3109->3111 3110->3057 3111->3110 3112->3076 3114 405c0d 3113->3114 3115 40601a SetFileAttributesW 3113->3115 3114->3097 3114->3098 3114->3099 3115->3114 3117 4061b3 3116->3117 3118 4061d9 GetShortPathNameW 3116->3118 3143 40602d GetFileAttributesW CreateFileW 3117->3143 3120 4062f8 3118->3120 3121 4061ee 3118->3121 3120->3105 3121->3120 3123 4061f6 wsprintfA 3121->3123 3122 4061bd CloseHandle GetShortPathNameW 3122->3120 3124 4061d1 3122->3124 3125 40657a 17 API calls 3123->3125 3124->3118 3124->3120 3126 40621e 3125->3126 3144 40602d GetFileAttributesW CreateFileW 3126->3144 3128 40622b 3128->3120 3129 40623a GetFileSize GlobalAlloc 3128->3129 3130 4062f1 CloseHandle 3129->3130 3131 40625c 3129->3131 3130->3120 3145 4060b0 ReadFile 3131->3145 3136 40627b lstrcpyA 3139 40629d 3136->3139 3137 40628f 3138 405f92 4 API calls 3137->3138 3138->3139 3140 4062d4 SetFilePointer 3139->3140 3152 4060df WriteFile 3140->3152 3143->3122 3144->3128 3146 4060ce 3145->3146 3146->3130 3147 405f92 lstrlenA 3146->3147 3148 405fd3 lstrlenA 3147->3148 3149 405fdb 3148->3149 3150 405fac lstrcmpiA 3148->3150 3149->3136 3149->3137 3150->3149 3151 405fca CharNextA 3150->3151 3151->3148 3153 4060fd GlobalFree 3152->3153 3153->3130 3168 401c43 3169 402d84 17 API calls 3168->3169 3170 401c4a 3169->3170 3171 402d84 17 API calls 3170->3171 3172 401c57 3171->3172 3173 401c6c 3172->3173 3174 402da6 17 API calls 3172->3174 3175 401c7c 3173->3175 3176 402da6 17 API calls 3173->3176 3174->3173 3177 401cd3 3175->3177 3178 401c87 3175->3178 3176->3175 3180 402da6 17 API calls 3177->3180 3179 402d84 17 API calls 3178->3179 3182 401c8c 3179->3182 3181 401cd8 3180->3181 3183 402da6 17 API calls 3181->3183 3184 402d84 17 API calls 3182->3184 3185 401ce1 FindWindowExW 3183->3185 3186 401c98 3184->3186 3189 401d03 3185->3189 3187 401cc3 SendMessageW 3186->3187 3188 401ca5 SendMessageTimeoutW 3186->3188 3187->3189 3188->3189 3834 404943 3835 404953 3834->3835 3836 404979 3834->3836 3837 404499 18 API calls 3835->3837 3838 404500 8 API calls 3836->3838 3839 404960 SetDlgItemTextW 3837->3839 3840 404985 3838->3840 3839->3836 3841 4028c4 3842 4028ca 3841->3842 3843 4028d2 FindClose 3842->3843 3844 402c2a 3842->3844 3843->3844 3848 4016cc 3849 402da6 17 API calls 3848->3849 3850 4016d2 GetFullPathNameW 3849->3850 3851 4016ec 3850->3851 3857 40170e 3850->3857 3854 406873 2 API calls 3851->3854 3851->3857 3852 401723 GetShortPathNameW 3853 402c2a 3852->3853 3855 4016fe 3854->3855 3855->3857 3858 40653d lstrcpynW 3855->3858 3857->3852 3857->3853 3858->3857 3859 401e4e GetDC 3860 402d84 17 API calls 3859->3860 3861 401e60 GetDeviceCaps MulDiv ReleaseDC 3860->3861 3862 402d84 17 API calls 3861->3862 3863 401e91 3862->3863 3864 40657a 17 API calls 3863->3864 3865 401ece CreateFontIndirectW 3864->3865 3866 402638 3865->3866 3867 4045cf lstrcpynW lstrlenW 3868 402950 3869 402da6 17 API calls 3868->3869 3871 40295c 3869->3871 3870 402972 3873 406008 2 API calls 3870->3873 3871->3870 3872 402da6 17 API calls 3871->3872 3872->3870 3874 402978 3873->3874 3896 40602d GetFileAttributesW CreateFileW 3874->3896 3876 402985 3877 402a3b 3876->3877 3878 4029a0 GlobalAlloc 3876->3878 3879 402a23 3876->3879 3880 402a42 DeleteFileW 3877->3880 3881 402a55 3877->3881 3878->3879 3882 4029b9 3878->3882 3883 4032b4 31 API calls 3879->3883 3880->3881 3897 4034e5 SetFilePointer 3882->3897 3885 402a30 CloseHandle 3883->3885 3885->3877 3886 4029bf 3887 4034cf ReadFile 3886->3887 3888 4029c8 GlobalAlloc 3887->3888 3889 4029d8 3888->3889 3890 402a0c 3888->3890 3891 4032b4 31 API calls 3889->3891 3892 4060df WriteFile 3890->3892 3895 4029e5 3891->3895 3893 402a18 GlobalFree 3892->3893 3893->3879 3894 402a03 GlobalFree 3894->3890 3895->3894 3896->3876 3897->3886 3898 401956 3899 402da6 17 API calls 3898->3899 3900 40195d lstrlenW 3899->3900 3901 402638 3900->3901 3902 4014d7 3903 402d84 17 API calls 3902->3903 3904 4014dd Sleep 3903->3904 3906 402c2a 3904->3906 3617 4020d8 3618 4020ea 3617->3618 3628 40219c 3617->3628 3619 402da6 17 API calls 3618->3619 3621 4020f1 3619->3621 3620 401423 24 API calls 3626 4022f6 3620->3626 3622 402da6 17 API calls 3621->3622 3623 4020fa 3622->3623 3624 402110 LoadLibraryExW 3623->3624 3625 402102 GetModuleHandleW 3623->3625 3627 402121 3624->3627 3624->3628 3625->3624 3625->3627 3637 406979 3627->3637 3628->3620 3631 402132 3634 401423 24 API calls 3631->3634 3635 402142 3631->3635 3632 40216b 3633 40559f 24 API calls 3632->3633 3633->3635 3634->3635 3635->3626 3636 40218e FreeLibrary 3635->3636 3636->3626 3642 40655f WideCharToMultiByte 3637->3642 3639 406996 3640 40699d GetProcAddress 3639->3640 3641 40212c 3639->3641 3640->3641 3641->3631 3641->3632 3642->3639 3907 404658 3908 404670 3907->3908 3914 40478a 3907->3914 3915 404499 18 API calls 3908->3915 3909 4047f4 3910 4048be 3909->3910 3911 4047fe GetDlgItem 3909->3911 3916 404500 8 API calls 3910->3916 3912 404818 3911->3912 3913 40487f 3911->3913 3912->3913 3920 40483e SendMessageW LoadCursorW SetCursor 3912->3920 3913->3910 3921 404891 3913->3921 3914->3909 3914->3910 3917 4047c5 GetDlgItem SendMessageW 3914->3917 3918 4046d7 3915->3918 3919 4048b9 3916->3919 3940 4044bb KiUserCallbackDispatcher 3917->3940 3923 404499 18 API calls 3918->3923 3944 404907 3920->3944 3926 4048a7 3921->3926 3927 404897 SendMessageW 3921->3927 3924 4046e4 CheckDlgButton 3923->3924 3938 4044bb KiUserCallbackDispatcher 3924->3938 3926->3919 3931 4048ad SendMessageW 3926->3931 3927->3926 3928 4047ef 3941 4048e3 3928->3941 3931->3919 3933 404702 GetDlgItem 3939 4044ce SendMessageW 3933->3939 3935 404718 SendMessageW 3936 404735 GetSysColor 3935->3936 3937 40473e SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 3935->3937 3936->3937 3937->3919 3938->3933 3939->3935 3940->3928 3942 4048f1 3941->3942 3943 4048f6 SendMessageW 3941->3943 3942->3943 3943->3909 3947 405b63 ShellExecuteExW 3944->3947 3946 40486d LoadCursorW SetCursor 3946->3913 3947->3946 3948 402b59 3949 402b60 3948->3949 3950 402bab 3948->3950 3953 402d84 17 API calls 3949->3953 3956 402ba9 3949->3956 3951 40690a 5 API calls 3950->3951 3952 402bb2 3951->3952 3954 402da6 17 API calls 3952->3954 3955 402b6e 3953->3955 3957 402bbb 3954->3957 3958 402d84 17 API calls 3955->3958 3957->3956 3959 402bbf IIDFromString 3957->3959 3961 402b7a 3958->3961 3959->3956 3960 402bce 3959->3960 3960->3956 3966 40653d lstrcpynW 3960->3966 3965 406484 wsprintfW 3961->3965 3964 402beb CoTaskMemFree 3964->3956 3965->3956 3966->3964 3760 40175c 3761 402da6 17 API calls 3760->3761 3762 401763 3761->3762 3763 40605c 2 API calls 3762->3763 3764 40176a 3763->3764 3765 40605c 2 API calls 3764->3765 3765->3764 3967 401d5d 3968 402d84 17 API calls 3967->3968 3969 401d6e SetWindowLongW 3968->3969 3970 402c2a 3969->3970 3766 4056de 3767 405888 3766->3767 3768 4056ff GetDlgItem GetDlgItem GetDlgItem 3766->3768 3770 405891 GetDlgItem CreateThread CloseHandle 3767->3770 3771 4058b9 3767->3771 3811 4044ce SendMessageW 3768->3811 3770->3771 3814 405672 5 API calls 3770->3814 3773 4058e4 3771->3773 3775 4058d0 ShowWindow ShowWindow 3771->3775 3776 405909 3771->3776 3772 40576f 3780 405776 GetClientRect GetSystemMetrics SendMessageW SendMessageW 3772->3780 3774 405944 3773->3774 3777 4058f8 3773->3777 3778 40591e ShowWindow 3773->3778 3774->3776 3787 405952 SendMessageW 3774->3787 3813 4044ce SendMessageW 3775->3813 3779 404500 8 API calls 3776->3779 3782 404472 SendMessageW 3777->3782 3783 405930 3778->3783 3784 40593e 3778->3784 3792 405917 3779->3792 3785 4057e4 3780->3785 3786 4057c8 SendMessageW SendMessageW 3780->3786 3782->3776 3788 40559f 24 API calls 3783->3788 3789 404472 SendMessageW 3784->3789 3790 4057f7 3785->3790 3791 4057e9 SendMessageW 3785->3791 3786->3785 3787->3792 3793 40596b CreatePopupMenu 3787->3793 3788->3784 3789->3774 3795 404499 18 API calls 3790->3795 3791->3790 3794 40657a 17 API calls 3793->3794 3796 40597b AppendMenuW 3794->3796 3797 405807 3795->3797 3798 405998 GetWindowRect 3796->3798 3799 4059ab TrackPopupMenu 3796->3799 3800 405810 ShowWindow 3797->3800 3801 405844 GetDlgItem SendMessageW 3797->3801 3798->3799 3799->3792 3802 4059c6 3799->3802 3803 405833 3800->3803 3804 405826 ShowWindow 3800->3804 3801->3792 3805 40586b SendMessageW SendMessageW 3801->3805 3806 4059e2 SendMessageW 3802->3806 3812 4044ce SendMessageW 3803->3812 3804->3803 3805->3792 3806->3806 3807 4059ff OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 3806->3807 3809 405a24 SendMessageW 3807->3809 3809->3809 3810 405a4d GlobalUnlock SetClipboardData CloseClipboard 3809->3810 3810->3792 3811->3772 3812->3801 3813->3773 3815 401ede 3816 402d84 17 API calls 3815->3816 3817 401ee4 3816->3817 3818 402d84 17 API calls 3817->3818 3819 401ef0 3818->3819 3820 401f07 EnableWindow 3819->3820 3821 401efc ShowWindow 3819->3821 3822 402c2a 3820->3822 3821->3822 3971 4028de 3972 4028e6 3971->3972 3973 4028ea FindNextFileW 3972->3973 3976 4028fc 3972->3976 3974 402943 3973->3974 3973->3976 3977 40653d lstrcpynW 3974->3977 3977->3976 3978 404ce0 3979 404cf0 3978->3979 3980 404d0c 3978->3980 3989 405b81 GetDlgItemTextW 3979->3989 3981 404d12 SHGetPathFromIDListW 3980->3981 3982 404d3f 3980->3982 3984 404d29 SendMessageW 3981->3984 3985 404d22 3981->3985 3984->3982 3987 40140b 2 API calls 3985->3987 3986 404cfd SendMessageW 3986->3980 3987->3984 3989->3986 3190 405b63 ShellExecuteExW 3990 401563 3991 402ba4 3990->3991 3994 406484 wsprintfW 3991->3994 3993 402ba9 3994->3993 3995 401968 3996 402d84 17 API calls 3995->3996 3997 40196f 3996->3997 3998 402d84 17 API calls 3997->3998 3999 40197c 3998->3999 4000 402da6 17 API calls 3999->4000 4001 401993 lstrlenW 4000->4001 4002 4019a4 4001->4002 4006 4019e5 4002->4006 4007 40653d lstrcpynW 4002->4007 4004 4019d5 4005 4019da lstrlenW 4004->4005 4004->4006 4005->4006 4007->4004 4008 40166a 4009 402da6 17 API calls 4008->4009 4010 401670 4009->4010 4011 406873 2 API calls 4010->4011 4012 401676 4011->4012 4013 402aeb 4014 402d84 17 API calls 4013->4014 4015 402af1 4014->4015 4016 40292e 4015->4016 4017 40657a 17 API calls 4015->4017 4017->4016 3286 4026ec 3287 402d84 17 API calls 3286->3287 3288 4026fb 3287->3288 3289 402745 ReadFile 3288->3289 3290 4060b0 ReadFile 3288->3290 3291 4027de 3288->3291 3293 402785 MultiByteToWideChar 3288->3293 3294 40283a 3288->3294 3296 4027ab SetFilePointer MultiByteToWideChar 3288->3296 3297 40284b 3288->3297 3299 402838 3288->3299 3289->3288 3289->3299 3290->3288 3291->3288 3291->3299 3300 40610e SetFilePointer 3291->3300 3293->3288 3309 406484 wsprintfW 3294->3309 3296->3288 3298 40286c SetFilePointer 3297->3298 3297->3299 3298->3299 3301 40612a 3300->3301 3304 406142 3300->3304 3302 4060b0 ReadFile 3301->3302 3303 406136 3302->3303 3303->3304 3305 406173 SetFilePointer 3303->3305 3306 40614b SetFilePointer 3303->3306 3304->3291 3305->3304 3306->3305 3307 406156 3306->3307 3308 4060df WriteFile 3307->3308 3308->3304 3309->3299 3556 40176f 3557 402da6 17 API calls 3556->3557 3558 401776 3557->3558 3559 401796 3558->3559 3560 40179e 3558->3560 3595 40653d lstrcpynW 3559->3595 3596 40653d lstrcpynW 3560->3596 3563 40179c 3567 4067c4 5 API calls 3563->3567 3564 4017a9 3565 405e0c 3 API calls 3564->3565 3566 4017af lstrcatW 3565->3566 3566->3563 3584 4017bb 3567->3584 3568 406873 2 API calls 3568->3584 3569 406008 2 API calls 3569->3584 3571 4017cd CompareFileTime 3571->3584 3572 40188d 3574 40559f 24 API calls 3572->3574 3573 401864 3575 40559f 24 API calls 3573->3575 3579 401879 3573->3579 3577 401897 3574->3577 3575->3579 3576 40653d lstrcpynW 3576->3584 3578 4032b4 31 API calls 3577->3578 3580 4018aa 3578->3580 3581 4018be SetFileTime 3580->3581 3582 4018d0 CloseHandle 3580->3582 3581->3582 3582->3579 3585 4018e1 3582->3585 3583 40657a 17 API calls 3583->3584 3584->3568 3584->3569 3584->3571 3584->3572 3584->3573 3584->3576 3584->3583 3590 405b9d MessageBoxIndirectW 3584->3590 3594 40602d GetFileAttributesW CreateFileW 3584->3594 3586 4018e6 3585->3586 3587 4018f9 3585->3587 3588 40657a 17 API calls 3586->3588 3589 40657a 17 API calls 3587->3589 3591 4018ee lstrcatW 3588->3591 3592 401901 3589->3592 3590->3584 3591->3592 3593 405b9d MessageBoxIndirectW 3592->3593 3593->3579 3594->3584 3595->3563 3596->3564 4018 401a72 4019 402d84 17 API calls 4018->4019 4020 401a7b 4019->4020 4021 402d84 17 API calls 4020->4021 4022 401a20 4021->4022 4023 401573 4024 401583 ShowWindow 4023->4024 4025 40158c 4023->4025 4024->4025 4026 402c2a 4025->4026 4027 40159a ShowWindow 4025->4027 4027->4026 4028 4023f4 4029 402da6 17 API calls 4028->4029 4030 402403 4029->4030 4031 402da6 17 API calls 4030->4031 4032 40240c 4031->4032 4033 402da6 17 API calls 4032->4033 4034 402416 GetPrivateProfileStringW 4033->4034 4035 4014f5 SetForegroundWindow 4036 402c2a 4035->4036 4037 401ff6 4038 402da6 17 API calls 4037->4038 4039 401ffd 4038->4039 4040 406873 2 API calls 4039->4040 4041 402003 4040->4041 4043 402014 4041->4043 4044 406484 wsprintfW 4041->4044 4044->4043 4045 401b77 4046 402da6 17 API calls 4045->4046 4047 401b7e 4046->4047 4048 402d84 17 API calls 4047->4048 4049 401b87 wsprintfW 4048->4049 4050 402c2a 4049->4050 4051 40167b 4052 402da6 17 API calls 4051->4052 4053 401682 4052->4053 4054 402da6 17 API calls 4053->4054 4055 40168b 4054->4055 4056 402da6 17 API calls 4055->4056 4057 401694 MoveFileW 4056->4057 4058 4016a7 4057->4058 4064 4016a0 4057->4064 4060 406873 2 API calls 4058->4060 4062 4022f6 4058->4062 4059 401423 24 API calls 4059->4062 4061 4016b6 4060->4061 4061->4062 4063 4062fd 36 API calls 4061->4063 4063->4064 4064->4059 4065 4019ff 4066 402da6 17 API calls 4065->4066 4067 401a06 4066->4067 4068 402da6 17 API calls 4067->4068 4069 401a0f 4068->4069 4070 401a16 lstrcmpiW 4069->4070 4071 401a28 lstrcmpW 4069->4071 4072 401a1c 4070->4072 4071->4072 4073 4022ff 4074 402da6 17 API calls 4073->4074 4075 402305 4074->4075 4076 402da6 17 API calls 4075->4076 4077 40230e 4076->4077 4078 402da6 17 API calls 4077->4078 4079 402317 4078->4079 4080 406873 2 API calls 4079->4080 4081 402320 4080->4081 4082 402331 lstrlenW lstrlenW 4081->4082 4083 402324 4081->4083 4085 40559f 24 API calls 4082->4085 4084 40559f 24 API calls 4083->4084 4087 40232c 4083->4087 4084->4087 4086 40236f SHFileOperationW 4085->4086 4086->4083 4086->4087 4088 401000 4089 401037 BeginPaint GetClientRect 4088->4089 4090 40100c DefWindowProcW 4088->4090 4092 4010f3 4089->4092 4095 401179 4090->4095 4093 401073 CreateBrushIndirect FillRect DeleteObject 4092->4093 4094 4010fc 4092->4094 4093->4092 4096 401102 CreateFontIndirectW 4094->4096 4097 401167 EndPaint 4094->4097 4096->4097 4098 401112 6 API calls 4096->4098 4097->4095 4098->4097 3154 401d81 3155 401d94 GetDlgItem 3154->3155 3156 401d87 3154->3156 3157 401d8e 3155->3157 3165 402d84 3156->3165 3159 401dd5 GetClientRect LoadImageW SendMessageW 3157->3159 3160 402da6 17 API calls 3157->3160 3162 401e33 3159->3162 3164 401e3f 3159->3164 3160->3159 3163 401e38 DeleteObject 3162->3163 3162->3164 3163->3164 3166 40657a 17 API calls 3165->3166 3167 402d99 3166->3167 3167->3157 4099 401503 4100 40150b 4099->4100 4102 40151e 4099->4102 4101 402d84 17 API calls 4100->4101 4101->4102 4103 402383 4104 40238a 4103->4104 4107 40239d 4103->4107 4105 40657a 17 API calls 4104->4105 4106 402397 4105->4106 4108 405b9d MessageBoxIndirectW 4106->4108 4108->4107 3217 402c05 SendMessageW 3218 402c2a 3217->3218 3219 402c1f InvalidateRect 3217->3219 3219->3218 4109 404f06 GetDlgItem GetDlgItem 4110 404f58 7 API calls 4109->4110 4116 40517d 4109->4116 4111 404ff2 SendMessageW 4110->4111 4112 404fff DeleteObject 4110->4112 4111->4112 4113 405008 4112->4113 4114 40503f 4113->4114 4117 40657a 17 API calls 4113->4117 4118 404499 18 API calls 4114->4118 4115 40525f 4119 40530b 4115->4119 4129 4052b8 SendMessageW 4115->4129 4149 405170 4115->4149 4116->4115 4120 4051ec 4116->4120 4163 404e54 SendMessageW 4116->4163 4123 405021 SendMessageW SendMessageW 4117->4123 4124 405053 4118->4124 4121 405315 SendMessageW 4119->4121 4122 40531d 4119->4122 4120->4115 4125 405251 SendMessageW 4120->4125 4121->4122 4131 405336 4122->4131 4132 40532f ImageList_Destroy 4122->4132 4147 405346 4122->4147 4123->4113 4128 404499 18 API calls 4124->4128 4125->4115 4126 404500 8 API calls 4130 40550c 4126->4130 4142 405064 4128->4142 4134 4052cd SendMessageW 4129->4134 4129->4149 4135 40533f GlobalFree 4131->4135 4131->4147 4132->4131 4133 4054c0 4138 4054d2 ShowWindow GetDlgItem ShowWindow 4133->4138 4133->4149 4137 4052e0 4134->4137 4135->4147 4136 40513f GetWindowLongW SetWindowLongW 4139 405158 4136->4139 4148 4052f1 SendMessageW 4137->4148 4138->4149 4140 405175 4139->4140 4141 40515d ShowWindow 4139->4141 4162 4044ce SendMessageW 4140->4162 4161 4044ce SendMessageW 4141->4161 4142->4136 4143 40513a 4142->4143 4146 4050b7 SendMessageW 4142->4146 4150 4050f5 SendMessageW 4142->4150 4151 405109 SendMessageW 4142->4151 4143->4136 4143->4139 4146->4142 4147->4133 4154 405381 4147->4154 4168 404ed4 4147->4168 4148->4119 4149->4126 4150->4142 4151->4142 4153 40548b 4155 405496 InvalidateRect 4153->4155 4158 4054a2 4153->4158 4156 4053af SendMessageW 4154->4156 4157 4053c5 4154->4157 4155->4158 4156->4157 4157->4153 4159 405439 SendMessageW SendMessageW 4157->4159 4158->4133 4177 404e0f 4158->4177 4159->4157 4161->4149 4162->4116 4164 404eb3 SendMessageW 4163->4164 4165 404e77 GetMessagePos ScreenToClient SendMessageW 4163->4165 4167 404eab 4164->4167 4166 404eb0 4165->4166 4165->4167 4166->4164 4167->4120 4180 40653d lstrcpynW 4168->4180 4170 404ee7 4181 406484 wsprintfW 4170->4181 4172 404ef1 4173 40140b 2 API calls 4172->4173 4174 404efa 4173->4174 4182 40653d lstrcpynW 4174->4182 4176 404f01 4176->4154 4183 404d46 4177->4183 4179 404e24 4179->4133 4180->4170 4181->4172 4182->4176 4184 404d5f 4183->4184 4185 40657a 17 API calls 4184->4185 4186 404dc3 4185->4186 4187 40657a 17 API calls 4186->4187 4188 404dce 4187->4188 4189 40657a 17 API calls 4188->4189 4190 404de4 lstrlenW wsprintfW SetDlgItemTextW 4189->4190 4190->4179 4191 404609 lstrlenW 4192 404628 4191->4192 4193 40462a WideCharToMultiByte 4191->4193 4192->4193 3220 40248a 3221 402da6 17 API calls 3220->3221 3222 40249c 3221->3222 3223 402da6 17 API calls 3222->3223 3224 4024a6 3223->3224 3237 402e36 3224->3237 3227 40292e 3228 4024de 3230 4024ea 3228->3230 3232 402d84 17 API calls 3228->3232 3229 402da6 17 API calls 3231 4024d4 lstrlenW 3229->3231 3233 402509 RegSetValueExW 3230->3233 3241 4032b4 3230->3241 3231->3228 3232->3230 3235 40251f RegCloseKey 3233->3235 3235->3227 3238 402e51 3237->3238 3261 4063d8 3238->3261 3242 4032cd 3241->3242 3243 4032fb 3242->3243 3268 4034e5 SetFilePointer 3242->3268 3265 4034cf 3243->3265 3247 403468 3249 4034aa 3247->3249 3252 40346c 3247->3252 3248 403318 GetTickCount 3253 403452 3248->3253 3257 403367 3248->3257 3250 4034cf ReadFile 3249->3250 3250->3253 3251 4034cf ReadFile 3251->3257 3252->3253 3254 4034cf ReadFile 3252->3254 3255 4060df WriteFile 3252->3255 3253->3233 3254->3252 3255->3252 3256 4033bd GetTickCount 3256->3257 3257->3251 3257->3253 3257->3256 3258 4033e2 MulDiv wsprintfW 3257->3258 3260 4060df WriteFile 3257->3260 3259 40559f 24 API calls 3258->3259 3259->3257 3260->3257 3262 4063e7 3261->3262 3263 4063f2 RegCreateKeyExW 3262->3263 3264 4024b6 3262->3264 3263->3264 3264->3227 3264->3228 3264->3229 3266 4060b0 ReadFile 3265->3266 3267 403306 3266->3267 3267->3247 3267->3248 3267->3253 3268->3243 4194 40498a 4195 4049b6 4194->4195 4196 4049c7 4194->4196 4255 405b81 GetDlgItemTextW 4195->4255 4197 4049d3 GetDlgItem 4196->4197 4204 404a32 4196->4204 4200 4049e7 4197->4200 4199 4049c1 4202 4067c4 5 API calls 4199->4202 4203 4049fb SetWindowTextW 4200->4203 4207 405eb7 4 API calls 4200->4207 4201 404b16 4253 404cc5 4201->4253 4257 405b81 GetDlgItemTextW 4201->4257 4202->4196 4208 404499 18 API calls 4203->4208 4204->4201 4209 40657a 17 API calls 4204->4209 4204->4253 4206 404500 8 API calls 4211 404cd9 4206->4211 4212 4049f1 4207->4212 4213 404a17 4208->4213 4214 404aa6 SHBrowseForFolderW 4209->4214 4210 404b46 4215 405f14 18 API calls 4210->4215 4212->4203 4219 405e0c 3 API calls 4212->4219 4216 404499 18 API calls 4213->4216 4214->4201 4217 404abe CoTaskMemFree 4214->4217 4218 404b4c 4215->4218 4220 404a25 4216->4220 4221 405e0c 3 API calls 4217->4221 4258 40653d lstrcpynW 4218->4258 4219->4203 4256 4044ce SendMessageW 4220->4256 4223 404acb 4221->4223 4226 404b02 SetDlgItemTextW 4223->4226 4230 40657a 17 API calls 4223->4230 4225 404a2b 4228 40690a 5 API calls 4225->4228 4226->4201 4227 404b63 4229 40690a 5 API calls 4227->4229 4228->4204 4241 404b6a 4229->4241 4231 404aea lstrcmpiW 4230->4231 4231->4226 4233 404afb lstrcatW 4231->4233 4232 404bab 4259 40653d lstrcpynW 4232->4259 4233->4226 4235 404bb2 4236 405eb7 4 API calls 4235->4236 4237 404bb8 GetDiskFreeSpaceW 4236->4237 4239 404bdc MulDiv 4237->4239 4243 404c03 4237->4243 4239->4243 4240 405e58 2 API calls 4240->4241 4241->4232 4241->4240 4241->4243 4242 404c74 4245 404c97 4242->4245 4247 40140b 2 API calls 4242->4247 4243->4242 4244 404e0f 20 API calls 4243->4244 4246 404c61 4244->4246 4260 4044bb KiUserCallbackDispatcher 4245->4260 4248 404c76 SetDlgItemTextW 4246->4248 4249 404c66 4246->4249 4247->4245 4248->4242 4251 404d46 20 API calls 4249->4251 4251->4242 4252 404cb3 4252->4253 4254 4048e3 SendMessageW 4252->4254 4253->4206 4254->4253 4255->4199 4256->4225 4257->4210 4258->4227 4259->4235 4260->4252 4261 40290b 4262 402da6 17 API calls 4261->4262 4263 402912 FindFirstFileW 4262->4263 4264 40293a 4263->4264 4267 402925 4263->4267 4269 406484 wsprintfW 4264->4269 4266 402943 4270 40653d lstrcpynW 4266->4270 4269->4266 4270->4267 4271 40190c 4272 401943 4271->4272 4273 402da6 17 API calls 4272->4273 4274 401948 4273->4274 4275 405c49 67 API calls 4274->4275 4276 401951 4275->4276 4277 40190f 4278 402da6 17 API calls 4277->4278 4279 401916 4278->4279 4280 405b9d MessageBoxIndirectW 4279->4280 4281 40191f 4280->4281 3597 402891 3598 402898 3597->3598 3599 402ba9 3597->3599 3600 402d84 17 API calls 3598->3600 3601 40289f 3600->3601 3602 4028ae SetFilePointer 3601->3602 3602->3599 3603 4028be 3602->3603 3605 406484 wsprintfW 3603->3605 3605->3599 4282 401491 4283 40559f 24 API calls 4282->4283 4284 401498 4283->4284 3606 403b12 3607 403b2a 3606->3607 3608 403b1c CloseHandle 3606->3608 3613 403b57 3607->3613 3608->3607 3611 405c49 67 API calls 3612 403b3b 3611->3612 3615 403b65 3613->3615 3614 403b2f 3614->3611 3615->3614 3616 403b6a FreeLibrary GlobalFree 3615->3616 3616->3614 3616->3616 4285 401f12 4286 402da6 17 API calls 4285->4286 4287 401f18 4286->4287 4288 402da6 17 API calls 4287->4288 4289 401f21 4288->4289 4290 402da6 17 API calls 4289->4290 4291 401f2a 4290->4291 4292 402da6 17 API calls 4291->4292 4293 401f33 4292->4293 4294 401423 24 API calls 4293->4294 4295 401f3a 4294->4295 4302 405b63 ShellExecuteExW 4295->4302 4297 401f82 4298 40292e 4297->4298 4299 4069b5 5 API calls 4297->4299 4300 401f9f CloseHandle 4299->4300 4300->4298 4302->4297 4303 405513 4304 405523 4303->4304 4305 405537 4303->4305 4306 405580 4304->4306 4307 405529 4304->4307 4308 40553f IsWindowVisible 4305->4308 4314 405556 4305->4314 4309 405585 CallWindowProcW 4306->4309 4310 4044e5 SendMessageW 4307->4310 4308->4306 4311 40554c 4308->4311 4312 405533 4309->4312 4310->4312 4313 404e54 5 API calls 4311->4313 4313->4314 4314->4309 4315 404ed4 4 API calls 4314->4315 4315->4306 4316 402f93 4317 402fa5 SetTimer 4316->4317 4318 402fbe 4316->4318 4317->4318 4319 403013 4318->4319 4320 402fd8 MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 4318->4320 4320->4319 4321 401d17 4322 402d84 17 API calls 4321->4322 4323 401d1d IsWindow 4322->4323 4324 401a20 4323->4324 3643 403f9a 3644 403fb2 3643->3644 3645 404113 3643->3645 3644->3645 3646 403fbe 3644->3646 3647 404164 3645->3647 3648 404124 GetDlgItem GetDlgItem 3645->3648 3650 403fc9 SetWindowPos 3646->3650 3651 403fdc 3646->3651 3649 4041be 3647->3649 3660 401389 2 API calls 3647->3660 3652 404499 18 API calls 3648->3652 3653 4044e5 SendMessageW 3649->3653 3661 40410e 3649->3661 3650->3651 3654 403fe5 ShowWindow 3651->3654 3655 404027 3651->3655 3656 40414e SetClassLongW 3652->3656 3682 4041d0 3653->3682 3662 4040d1 3654->3662 3663 404005 GetWindowLongW 3654->3663 3657 404046 3655->3657 3658 40402f DestroyWindow 3655->3658 3659 40140b 2 API calls 3656->3659 3665 40404b SetWindowLongW 3657->3665 3666 40405c 3657->3666 3664 404422 3658->3664 3659->3647 3667 404196 3660->3667 3723 404500 3662->3723 3663->3662 3669 40401e ShowWindow 3663->3669 3664->3661 3676 404453 ShowWindow 3664->3676 3665->3661 3666->3662 3670 404068 GetDlgItem 3666->3670 3667->3649 3671 40419a SendMessageW 3667->3671 3669->3655 3674 404096 3670->3674 3675 404079 SendMessageW IsWindowEnabled 3670->3675 3671->3661 3672 40140b 2 API calls 3672->3682 3673 404424 DestroyWindow KiUserCallbackDispatcher 3673->3664 3678 4040a3 3674->3678 3680 4040ea SendMessageW 3674->3680 3681 4040b6 3674->3681 3688 40409b 3674->3688 3675->3661 3675->3674 3676->3661 3677 40657a 17 API calls 3677->3682 3678->3680 3678->3688 3680->3662 3683 4040d3 3681->3683 3684 4040be 3681->3684 3682->3661 3682->3672 3682->3673 3682->3677 3685 404499 18 API calls 3682->3685 3705 404364 DestroyWindow 3682->3705 3714 404499 3682->3714 3686 40140b 2 API calls 3683->3686 3687 40140b 2 API calls 3684->3687 3685->3682 3686->3688 3687->3688 3688->3662 3720 404472 3688->3720 3690 40424b GetDlgItem 3691 404260 3690->3691 3692 404268 ShowWindow KiUserCallbackDispatcher 3690->3692 3691->3692 3717 4044bb KiUserCallbackDispatcher 3692->3717 3694 404292 KiUserCallbackDispatcher 3699 4042a6 3694->3699 3695 4042ab GetSystemMenu EnableMenuItem SendMessageW 3696 4042db SendMessageW 3695->3696 3695->3699 3696->3699 3698 403f7b 18 API calls 3698->3699 3699->3695 3699->3698 3718 4044ce SendMessageW 3699->3718 3719 40653d lstrcpynW 3699->3719 3701 40430a lstrlenW 3702 40657a 17 API calls 3701->3702 3703 404320 SetWindowTextW 3702->3703 3704 401389 2 API calls 3703->3704 3704->3682 3705->3664 3706 40437e CreateDialogParamW 3705->3706 3706->3664 3707 4043b1 3706->3707 3708 404499 18 API calls 3707->3708 3709 4043bc GetDlgItem GetWindowRect ScreenToClient SetWindowPos 3708->3709 3710 401389 2 API calls 3709->3710 3711 404402 3710->3711 3711->3661 3712 40440a ShowWindow 3711->3712 3713 4044e5 SendMessageW 3712->3713 3713->3664 3715 40657a 17 API calls 3714->3715 3716 4044a4 SetDlgItemTextW 3715->3716 3716->3690 3717->3694 3718->3699 3719->3701 3721 404479 3720->3721 3722 40447f SendMessageW 3720->3722 3721->3722 3722->3662 3724 4045c3 3723->3724 3725 404518 GetWindowLongW 3723->3725 3724->3661 3725->3724 3726 40452d 3725->3726 3726->3724 3727 40455a GetSysColor 3726->3727 3728 40455d 3726->3728 3727->3728 3729 404563 SetTextColor 3728->3729 3730 40456d SetBkMode 3728->3730 3729->3730 3731 404585 GetSysColor 3730->3731 3732 40458b 3730->3732 3731->3732 3733 404592 SetBkColor 3732->3733 3734 40459c 3732->3734 3733->3734 3734->3724 3735 4045b6 CreateBrushIndirect 3734->3735 3736 4045af DeleteObject 3734->3736 3735->3724 3736->3735 3737 401b9b 3738 401ba8 3737->3738 3739 401bec 3737->3739 3744 401c31 3738->3744 3745 401bbf 3738->3745 3740 401bf1 3739->3740 3741 401c16 GlobalAlloc 3739->3741 3746 40239d 3740->3746 3756 40653d lstrcpynW 3740->3756 3742 40657a 17 API calls 3741->3742 3742->3744 3743 40657a 17 API calls 3747 402397 3743->3747 3744->3743 3744->3746 3757 40653d lstrcpynW 3745->3757 3752 405b9d MessageBoxIndirectW 3747->3752 3750 401c03 GlobalFree 3750->3746 3751 401bce 3758 40653d lstrcpynW 3751->3758 3752->3746 3754 401bdd 3759 40653d lstrcpynW 3754->3759 3756->3750 3757->3751 3758->3754 3759->3746 4325 40261c 4326 402da6 17 API calls 4325->4326 4327 402623 4326->4327 4330 40602d GetFileAttributesW CreateFileW 4327->4330 4329 40262f 4330->4329 3823 40259e 3824 402de6 17 API calls 3823->3824 3825 4025a8 3824->3825 3826 402d84 17 API calls 3825->3826 3827 4025b1 3826->3827 3828 4025d9 RegEnumValueW 3827->3828 3829 4025cd RegEnumKeyW 3827->3829 3830 40292e 3827->3830 3831 4025f5 RegCloseKey 3828->3831 3832 4025ee 3828->3832 3829->3831 3831->3830 3832->3831 4331 40149e 4332 4014ac PostQuitMessage 4331->4332 4333 40239d 4331->4333 4332->4333 4334 4015a3 4335 402da6 17 API calls 4334->4335 4336 4015aa SetFileAttributesW 4335->4336 4337 4015bc 4336->4337 3191 401fa4 3192 402da6 17 API calls 3191->3192 3193 401faa 3192->3193 3194 40559f 24 API calls 3193->3194 3195 401fb4 3194->3195 3204 405b20 CreateProcessW 3195->3204 3198 40292e 3201 401fcf 3202 401fdd CloseHandle 3201->3202 3212 406484 wsprintfW 3201->3212 3202->3198 3205 405b53 CloseHandle 3204->3205 3206 401fba 3204->3206 3205->3206 3206->3198 3206->3202 3207 4069b5 WaitForSingleObject 3206->3207 3208 4069cf 3207->3208 3209 4069e1 GetExitCodeProcess 3208->3209 3213 406946 3208->3213 3209->3201 3212->3202 3214 406963 PeekMessageW 3213->3214 3215 406973 WaitForSingleObject 3214->3215 3216 406959 DispatchMessageW 3214->3216 3215->3208 3216->3214 3269 40252a 3280 402de6 3269->3280 3272 402da6 17 API calls 3273 40253d 3272->3273 3274 402548 RegQueryValueExW 3273->3274 3279 40292e 3273->3279 3275 40256e RegCloseKey 3274->3275 3276 402568 3274->3276 3275->3279 3276->3275 3285 406484 wsprintfW 3276->3285 3281 402da6 17 API calls 3280->3281 3282 402dfd 3281->3282 3283 4063aa RegOpenKeyExW 3282->3283 3284 402534 3283->3284 3284->3272 3285->3275 4338 40202a 4339 402da6 17 API calls 4338->4339 4340 402031 4339->4340 4341 40690a 5 API calls 4340->4341 4342 402040 4341->4342 4343 40205c GlobalAlloc 4342->4343 4346 4020cc 4342->4346 4344 402070 4343->4344 4343->4346 4345 40690a 5 API calls 4344->4345 4347 402077 4345->4347 4348 40690a 5 API calls 4347->4348 4349 402081 4348->4349 4349->4346 4353 406484 wsprintfW 4349->4353 4351 4020ba 4354 406484 wsprintfW 4351->4354 4353->4351 4354->4346 4355 4021aa 4356 402da6 17 API calls 4355->4356 4357 4021b1 4356->4357 4358 402da6 17 API calls 4357->4358 4359 4021bb 4358->4359 4360 402da6 17 API calls 4359->4360 4361 4021c5 4360->4361 4362 402da6 17 API calls 4361->4362 4363 4021cf 4362->4363 4364 402da6 17 API calls 4363->4364 4365 4021d9 4364->4365 4366 402218 CoCreateInstance 4365->4366 4367 402da6 17 API calls 4365->4367 4370 402237 4366->4370 4367->4366 4368 401423 24 API calls 4369 4022f6 4368->4369 4370->4368 4370->4369 4371 403baa 4372 403bb5 4371->4372 4373 403bb9 4372->4373 4374 403bbc GlobalAlloc 4372->4374 4374->4373 3310 40352d SetErrorMode GetVersionExW 3311 4035b7 3310->3311 3312 40357f GetVersionExW 3310->3312 3313 403610 3311->3313 3314 40690a 5 API calls 3311->3314 3312->3311 3315 40689a 3 API calls 3313->3315 3314->3313 3316 403626 lstrlenA 3315->3316 3316->3313 3317 403636 3316->3317 3318 40690a 5 API calls 3317->3318 3319 40363d 3318->3319 3320 40690a 5 API calls 3319->3320 3321 403644 3320->3321 3322 40690a 5 API calls 3321->3322 3326 403650 #17 OleInitialize SHGetFileInfoW 3322->3326 3325 40369d GetCommandLineW 3401 40653d lstrcpynW 3325->3401 3400 40653d lstrcpynW 3326->3400 3328 4036af 3329 405e39 CharNextW 3328->3329 3330 4036d5 CharNextW 3329->3330 3342 4036e6 3330->3342 3331 4037e4 3332 4037f8 GetTempPathW 3331->3332 3402 4034fc 3332->3402 3334 403810 3336 403814 GetWindowsDirectoryW lstrcatW 3334->3336 3337 40386a DeleteFileW 3334->3337 3335 405e39 CharNextW 3335->3342 3338 4034fc 12 API calls 3336->3338 3412 40307d GetTickCount GetModuleFileNameW 3337->3412 3340 403830 3338->3340 3340->3337 3343 403834 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3340->3343 3341 40387d 3345 403a59 ExitProcess CoUninitialize 3341->3345 3347 403932 3341->3347 3355 405e39 CharNextW 3341->3355 3342->3331 3342->3335 3344 4037e6 3342->3344 3346 4034fc 12 API calls 3343->3346 3496 40653d lstrcpynW 3344->3496 3349 403a69 3345->3349 3350 403a7e 3345->3350 3354 403862 3346->3354 3440 403bec 3347->3440 3501 405b9d 3349->3501 3352 403a86 GetCurrentProcess OpenProcessToken 3350->3352 3353 403afc ExitProcess 3350->3353 3358 403acc 3352->3358 3359 403a9d LookupPrivilegeValueW AdjustTokenPrivileges 3352->3359 3354->3337 3354->3345 3369 40389f 3355->3369 3362 40690a 5 API calls 3358->3362 3359->3358 3360 403941 3360->3345 3365 403ad3 3362->3365 3363 403908 3366 405f14 18 API calls 3363->3366 3364 403949 3368 405b08 5 API calls 3364->3368 3367 403ae8 ExitWindowsEx 3365->3367 3371 403af5 3365->3371 3370 403914 3366->3370 3367->3353 3367->3371 3372 40394e lstrcatW 3368->3372 3369->3363 3369->3364 3370->3345 3497 40653d lstrcpynW 3370->3497 3505 40140b 3371->3505 3373 40396a lstrcatW lstrcmpiW 3372->3373 3374 40395f lstrcatW 3372->3374 3373->3360 3376 40398a 3373->3376 3374->3373 3378 403996 3376->3378 3379 40398f 3376->3379 3382 405aeb 2 API calls 3378->3382 3381 405a6e 4 API calls 3379->3381 3380 403927 3498 40653d lstrcpynW 3380->3498 3384 403994 3381->3384 3385 40399b SetCurrentDirectoryW 3382->3385 3384->3385 3386 4039b8 3385->3386 3387 4039ad 3385->3387 3500 40653d lstrcpynW 3386->3500 3499 40653d lstrcpynW 3387->3499 3390 40657a 17 API calls 3391 4039fa DeleteFileW 3390->3391 3392 403a06 CopyFileW 3391->3392 3397 4039c5 3391->3397 3392->3397 3393 403a50 3395 4062fd 36 API calls 3393->3395 3394 4062fd 36 API calls 3394->3397 3395->3360 3396 40657a 17 API calls 3396->3397 3397->3390 3397->3393 3397->3394 3397->3396 3398 405b20 2 API calls 3397->3398 3399 403a3a CloseHandle 3397->3399 3398->3397 3399->3397 3400->3325 3401->3328 3403 4067c4 5 API calls 3402->3403 3405 403508 3403->3405 3404 403512 3404->3334 3405->3404 3406 405e0c 3 API calls 3405->3406 3407 40351a 3406->3407 3408 405aeb 2 API calls 3407->3408 3409 403520 3408->3409 3508 40605c 3409->3508 3512 40602d GetFileAttributesW CreateFileW 3412->3512 3414 4030bd 3432 4030cd 3414->3432 3513 40653d lstrcpynW 3414->3513 3416 4030e3 3417 405e58 2 API calls 3416->3417 3418 4030e9 3417->3418 3514 40653d lstrcpynW 3418->3514 3420 4030f4 GetFileSize 3421 4031ee 3420->3421 3439 40310b 3420->3439 3515 403019 3421->3515 3423 4031f7 3425 403227 GlobalAlloc 3423->3425 3423->3432 3527 4034e5 SetFilePointer 3423->3527 3424 4034cf ReadFile 3424->3439 3526 4034e5 SetFilePointer 3425->3526 3427 40325a 3429 403019 6 API calls 3427->3429 3429->3432 3430 403210 3433 4034cf ReadFile 3430->3433 3431 403242 3434 4032b4 31 API calls 3431->3434 3432->3341 3435 40321b 3433->3435 3437 40324e 3434->3437 3435->3425 3435->3432 3436 403019 6 API calls 3436->3439 3437->3432 3437->3437 3438 40328b SetFilePointer 3437->3438 3438->3432 3439->3421 3439->3424 3439->3427 3439->3432 3439->3436 3441 40690a 5 API calls 3440->3441 3442 403c00 3441->3442 3443 403c06 3442->3443 3444 403c18 3442->3444 3543 406484 wsprintfW 3443->3543 3445 40640b 3 API calls 3444->3445 3446 403c48 3445->3446 3448 403c67 lstrcatW 3446->3448 3450 40640b 3 API calls 3446->3450 3449 403c16 3448->3449 3528 403ec2 3449->3528 3450->3448 3453 405f14 18 API calls 3454 403c99 3453->3454 3455 403d2d 3454->3455 3457 40640b 3 API calls 3454->3457 3456 405f14 18 API calls 3455->3456 3458 403d33 3456->3458 3459 403ccb 3457->3459 3460 403d43 LoadImageW 3458->3460 3461 40657a 17 API calls 3458->3461 3459->3455 3464 403cec lstrlenW 3459->3464 3467 405e39 CharNextW 3459->3467 3462 403de9 3460->3462 3463 403d6a RegisterClassW 3460->3463 3461->3460 3466 40140b 2 API calls 3462->3466 3465 403da0 SystemParametersInfoW CreateWindowExW 3463->3465 3495 403df3 3463->3495 3468 403d20 3464->3468 3469 403cfa lstrcmpiW 3464->3469 3465->3462 3473 403def 3466->3473 3471 403ce9 3467->3471 3470 405e0c 3 API calls 3468->3470 3469->3468 3472 403d0a GetFileAttributesW 3469->3472 3475 403d26 3470->3475 3471->3464 3476 403d16 3472->3476 3474 403ec2 18 API calls 3473->3474 3473->3495 3477 403e00 3474->3477 3544 40653d lstrcpynW 3475->3544 3476->3468 3479 405e58 2 API calls 3476->3479 3480 403e0c ShowWindow 3477->3480 3481 403e8f 3477->3481 3479->3468 3483 40689a 3 API calls 3480->3483 3536 405672 OleInitialize 3481->3536 3485 403e24 3483->3485 3484 403e95 3486 403eb1 3484->3486 3487 403e99 3484->3487 3488 403e32 GetClassInfoW 3485->3488 3490 40689a 3 API calls 3485->3490 3489 40140b 2 API calls 3486->3489 3493 40140b 2 API calls 3487->3493 3487->3495 3491 403e46 GetClassInfoW RegisterClassW 3488->3491 3492 403e5c DialogBoxParamW 3488->3492 3489->3495 3490->3488 3491->3492 3494 40140b 2 API calls 3492->3494 3493->3495 3494->3495 3495->3360 3496->3332 3497->3380 3498->3347 3499->3386 3500->3397 3502 405bb2 3501->3502 3503 403a76 ExitProcess 3502->3503 3504 405bc6 MessageBoxIndirectW 3502->3504 3504->3503 3506 401389 2 API calls 3505->3506 3507 401420 3506->3507 3507->3353 3509 406069 GetTickCount GetTempFileNameW 3508->3509 3510 40352b 3509->3510 3511 40609f 3509->3511 3510->3334 3511->3509 3511->3510 3512->3414 3513->3416 3514->3420 3516 403022 3515->3516 3517 40303a 3515->3517 3518 403032 3516->3518 3519 40302b DestroyWindow 3516->3519 3520 403042 3517->3520 3521 40304a GetTickCount 3517->3521 3518->3423 3519->3518 3522 406946 2 API calls 3520->3522 3523 403058 CreateDialogParamW ShowWindow 3521->3523 3524 40307b 3521->3524 3525 403048 3522->3525 3523->3524 3524->3423 3525->3423 3526->3431 3527->3430 3529 403ed6 3528->3529 3545 406484 wsprintfW 3529->3545 3531 403f47 3546 403f7b 3531->3546 3533 403c77 3533->3453 3534 403f4c 3534->3533 3535 40657a 17 API calls 3534->3535 3535->3534 3549 4044e5 3536->3549 3538 405695 3542 4056bc 3538->3542 3552 401389 3538->3552 3539 4044e5 SendMessageW 3540 4056ce OleUninitialize 3539->3540 3540->3484 3542->3539 3543->3449 3544->3455 3545->3531 3547 40657a 17 API calls 3546->3547 3548 403f89 SetWindowTextW 3547->3548 3548->3534 3550 4044fd 3549->3550 3551 4044ee SendMessageW 3549->3551 3550->3538 3551->3550 3554 401390 3552->3554 3553 4013fe 3553->3538 3554->3553 3555 4013cb MulDiv SendMessageW 3554->3555 3555->3554 4375 401a30 4376 402da6 17 API calls 4375->4376 4377 401a39 ExpandEnvironmentStringsW 4376->4377 4378 401a4d 4377->4378 4380 401a60 4377->4380 4379 401a52 lstrcmpW 4378->4379 4378->4380 4379->4380 4386 4023b2 4387 4023c0 4386->4387 4388 4023ba 4386->4388 4390 4023ce 4387->4390 4391 402da6 17 API calls 4387->4391 4389 402da6 17 API calls 4388->4389 4389->4387 4392 402da6 17 API calls 4390->4392 4394 4023dc 4390->4394 4391->4390 4392->4394 4393 402da6 17 API calls 4395 4023e5 WritePrivateProfileStringW 4393->4395 4394->4393 4396 402434 4397 402467 4396->4397 4398 40243c 4396->4398 4399 402da6 17 API calls 4397->4399 4400 402de6 17 API calls 4398->4400 4401 40246e 4399->4401 4402 402443 4400->4402 4407 402e64 4401->4407 4404 402da6 17 API calls 4402->4404 4405 40247b 4402->4405 4406 402454 RegDeleteValueW RegCloseKey 4404->4406 4406->4405 4408 402e71 4407->4408 4409 402e78 4407->4409 4408->4405 4409->4408 4411 402ea9 4409->4411 4412 4063aa RegOpenKeyExW 4411->4412 4413 402ed7 4412->4413 4414 402ee7 RegEnumValueW 4413->4414 4415 402f0a 4413->4415 4422 402f81 4413->4422 4414->4415 4416 402f71 RegCloseKey 4414->4416 4415->4416 4417 402f46 RegEnumKeyW 4415->4417 4418 402f4f RegCloseKey 4415->4418 4421 402ea9 6 API calls 4415->4421 4416->4422 4417->4415 4417->4418 4419 40690a 5 API calls 4418->4419 4420 402f5f 4419->4420 4420->4422 4423 402f63 RegDeleteKeyW 4420->4423 4421->4415 4422->4408 4423->4422 4424 401735 4425 402da6 17 API calls 4424->4425 4426 40173c SearchPathW 4425->4426 4427 401757 4426->4427 4428 401d38 4429 402d84 17 API calls 4428->4429 4430 401d3f 4429->4430 4431 402d84 17 API calls 4430->4431 4432 401d4b GetDlgItem 4431->4432 4433 402638 4432->4433 4434 4014b8 4435 4014be 4434->4435 4436 401389 2 API calls 4435->4436 4437 4014c6 4436->4437 4438 40263e 4439 402652 4438->4439 4440 40266d 4438->4440 4441 402d84 17 API calls 4439->4441 4442 402672 4440->4442 4443 40269d 4440->4443 4450 402659 4441->4450 4444 402da6 17 API calls 4442->4444 4445 402da6 17 API calls 4443->4445 4447 402679 4444->4447 4446 4026a4 lstrlenW 4445->4446 4446->4450 4455 40655f WideCharToMultiByte 4447->4455 4449 40268d lstrlenA 4449->4450 4451 4026d1 4450->4451 4452 4026e7 4450->4452 4454 40610e 5 API calls 4450->4454 4451->4452 4453 4060df WriteFile 4451->4453 4453->4452 4454->4451 4455->4449

                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                          Function 0040352D Relevance: 84.4, APIs: 34, Strings: 14, Instructions: 450stringfilecomCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 0 40352d-40357d SetErrorMode GetVersionExW 1 4035b7-4035be 0->1 2 40357f-4035b3 GetVersionExW 0->2 3 4035c0 1->3 4 4035c8-403608 1->4 2->1 3->4 5 40360a-403612 call 40690a 4->5 6 40361b 4->6 5->6 11 403614 5->11 8 403620-403634 call 40689a lstrlenA 6->8 13 403636-403652 call 40690a * 3 8->13 11->6 20 403663-4036c5 #17 OleInitialize SHGetFileInfoW call 40653d GetCommandLineW call 40653d 13->20 21 403654-40365a 13->21 28 4036c7-4036c9 20->28 29 4036ce-4036e1 call 405e39 CharNextW 20->29 21->20 25 40365c 21->25 25->20 28->29 32 4037d8-4037de 29->32 33 4037e4 32->33 34 4036e6-4036ec 32->34 37 4037f8-403812 GetTempPathW call 4034fc 33->37 35 4036f5-4036fb 34->35 36 4036ee-4036f3 34->36 38 403702-403706 35->38 39 4036fd-403701 35->39 36->35 36->36 47 403814-403832 GetWindowsDirectoryW lstrcatW call 4034fc 37->47 48 40386a-403882 DeleteFileW call 40307d 37->48 41 4037c6-4037d4 call 405e39 38->41 42 40370c-403712 38->42 39->38 41->32 59 4037d6-4037d7 41->59 45 403714-40371b 42->45 46 40372c-403765 42->46 52 403722 45->52 53 40371d-403720 45->53 54 403781-4037bb 46->54 55 403767-40376c 46->55 47->48 62 403834-403864 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 4034fc 47->62 64 403888-40388e 48->64 65 403a59-403a67 ExitProcess CoUninitialize 48->65 52->46 53->46 53->52 57 4037c3-4037c5 54->57 58 4037bd-4037c1 54->58 55->54 61 40376e-403776 55->61 57->41 58->57 63 4037e6-4037f3 call 40653d 58->63 59->32 66 403778-40377b 61->66 67 40377d 61->67 62->48 62->65 63->37 69 403894-4038a7 call 405e39 64->69 70 403935-40393c call 403bec 64->70 72 403a69-403a78 call 405b9d ExitProcess 65->72 73 403a7e-403a84 65->73 66->54 66->67 67->54 88 4038f9-403906 69->88 89 4038a9-4038de 69->89 84 403941-403944 70->84 75 403a86-403a9b GetCurrentProcess OpenProcessToken 73->75 76 403afc-403b04 73->76 81 403acc-403ada call 40690a 75->81 82 403a9d-403ac6 LookupPrivilegeValueW AdjustTokenPrivileges 75->82 85 403b06 76->85 86 403b09-403b0c ExitProcess 76->86 95 403ae8-403af3 ExitWindowsEx 81->95 96 403adc-403ae6 81->96 82->81 84->65 85->86 90 403908-403916 call 405f14 88->90 91 403949-40395d call 405b08 lstrcatW 88->91 93 4038e0-4038e4 89->93 90->65 106 40391c-403932 call 40653d * 2 90->106 104 40396a-403984 lstrcatW lstrcmpiW 91->104 105 40395f-403965 lstrcatW 91->105 98 4038e6-4038eb 93->98 99 4038ed-4038f5 93->99 95->76 102 403af5-403af7 call 40140b 95->102 96->95 96->102 98->99 100 4038f7 98->100 99->93 99->100 100->88 102->76 109 403a57 104->109 110 40398a-40398d 104->110 105->104 106->70 109->65 112 403996 call 405aeb 110->112 113 40398f-403994 call 405a6e 110->113 119 40399b-4039ab SetCurrentDirectoryW 112->119 113->119 121 4039b8-4039e4 call 40653d 119->121 122 4039ad-4039b3 call 40653d 119->122 126 4039e9-403a04 call 40657a DeleteFileW 121->126 122->121 129 403a44-403a4e 126->129 130 403a06-403a16 CopyFileW 126->130 129->126 132 403a50-403a52 call 4062fd 129->132 130->129 131 403a18-403a38 call 4062fd call 40657a call 405b20 130->131 131->129 140 403a3a-403a41 CloseHandle 131->140 132->109 140->129
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00008001), ref: 00403550
                                                                                                                                                                                                                          • GetVersionExW.KERNEL32(?), ref: 00403579
                                                                                                                                                                                                                          • GetVersionExW.KERNEL32(0000011C), ref: 00403590
                                                                                                                                                                                                                          • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403627
                                                                                                                                                                                                                          • #17.COMCTL32(00000007,00000009,0000000B), ref: 00403663
                                                                                                                                                                                                                          • OleInitialize.OLE32(00000000), ref: 0040366A
                                                                                                                                                                                                                          • SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 00403688
                                                                                                                                                                                                                          • GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 0040369D
                                                                                                                                                                                                                          • CharNextW.USER32(00000000,00440000,00000020,00440000,00000000), ref: 004036D6
                                                                                                                                                                                                                          • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 00403809
                                                                                                                                                                                                                          • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040381A
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403826
                                                                                                                                                                                                                          • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040383A
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403842
                                                                                                                                                                                                                          • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403853
                                                                                                                                                                                                                          • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040385B
                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(1033), ref: 0040386F
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403956
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403965
                                                                                                                                                                                                                            • Part of subcall function 00405AEB: CreateDirectoryW.KERNEL32(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403970
                                                                                                                                                                                                                          • lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00441800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 0040397C
                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040399C
                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(0042AA28,0042AA28,?,C:\Users\user\AppData\Local\Temp\nsb5A9.tmp,?), ref: 004039FB
                                                                                                                                                                                                                          • CopyFileW.KERNEL32(C:\Users\user\Desktop\Setup.exe,0042AA28,00000001), ref: 00403A0E
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403A3B
                                                                                                                                                                                                                          • ExitProcess.KERNEL32(?), ref: 00403A59
                                                                                                                                                                                                                          • CoUninitialize.COMBASE(?), ref: 00403A5E
                                                                                                                                                                                                                          • ExitProcess.KERNEL32 ref: 00403A78
                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403A8C
                                                                                                                                                                                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
                                                                                                                                                                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA7
                                                                                                                                                                                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403AC6
                                                                                                                                                                                                                          • ExitWindowsEx.USER32(00000002,80040002), ref: 00403AEB
                                                                                                                                                                                                                          • ExitProcess.KERNEL32 ref: 00403B0C
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
                                                                                                                                                                                                                          • String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsb5A9.tmp$C:\Users\user\Desktop\Setup.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                                                                          • API String ID: 2292928366-1954666279
                                                                                                                                                                                                                          • Opcode ID: a9950f16e1a4a62c6ded3d55c7a98e4382dcb346a085109a7b13f69721f27fd6
                                                                                                                                                                                                                          • Instruction ID: 4d4dc0a58e4858e72561def8a0259f0227da8af974c10a5ea2b310ef4b80d7a5
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a9950f16e1a4a62c6ded3d55c7a98e4382dcb346a085109a7b13f69721f27fd6
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 66E10670A00214AADB10AFB59D45BAF3AB8EF4470AF14847FF545B22D1DB7C8A41CB6D
                                                                                                                                                                                                                          Function 004056DE Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 141 4056de-4056f9 142 405888-40588f 141->142 143 4056ff-4057c6 GetDlgItem * 3 call 4044ce call 404e27 GetClientRect GetSystemMetrics SendMessageW * 2 141->143 145 405891-4058b3 GetDlgItem CreateThread CloseHandle 142->145 146 4058b9-4058c6 142->146 165 4057e4-4057e7 143->165 166 4057c8-4057e2 SendMessageW * 2 143->166 145->146 148 4058e4-4058ee 146->148 149 4058c8-4058ce 146->149 150 4058f0-4058f6 148->150 151 405944-405948 148->151 153 4058d0-4058df ShowWindow * 2 call 4044ce 149->153 154 405909-405912 call 404500 149->154 155 4058f8-405904 call 404472 150->155 156 40591e-40592e ShowWindow 150->156 151->154 159 40594a-405950 151->159 153->148 162 405917-40591b 154->162 155->154 163 405930-405939 call 40559f 156->163 164 40593e-40593f call 404472 156->164 159->154 167 405952-405965 SendMessageW 159->167 163->164 164->151 170 4057f7-40580e call 404499 165->170 171 4057e9-4057f5 SendMessageW 165->171 166->165 172 405a67-405a69 167->172 173 40596b-405996 CreatePopupMenu call 40657a AppendMenuW 167->173 180 405810-405824 ShowWindow 170->180 181 405844-405865 GetDlgItem SendMessageW 170->181 171->170 172->162 178 405998-4059a8 GetWindowRect 173->178 179 4059ab-4059c0 TrackPopupMenu 173->179 178->179 179->172 182 4059c6-4059dd 179->182 183 405833 180->183 184 405826-405831 ShowWindow 180->184 181->172 185 40586b-405883 SendMessageW * 2 181->185 186 4059e2-4059fd SendMessageW 182->186 187 405839-40583f call 4044ce 183->187 184->187 185->172 186->186 188 4059ff-405a22 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 186->188 187->181 190 405a24-405a4b SendMessageW 188->190 190->190 191 405a4d-405a61 GlobalUnlock SetClipboardData CloseClipboard 190->191 191->172
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000403), ref: 0040573C
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003EE), ref: 0040574B
                                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 00405788
                                                                                                                                                                                                                          • GetSystemMetrics.USER32(00000002), ref: 0040578F
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B0
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C1
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057D4
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E2
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001024,00000000,?), ref: 004057F5
                                                                                                                                                                                                                          • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405817
                                                                                                                                                                                                                          • ShowWindow.USER32(?,00000008), ref: 0040582B
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003EC), ref: 0040584C
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040585C
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405875
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405881
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003F8), ref: 0040575A
                                                                                                                                                                                                                            • Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003EC), ref: 0040589E
                                                                                                                                                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00005672,00000000), ref: 004058AC
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 004058B3
                                                                                                                                                                                                                          • ShowWindow.USER32(00000000), ref: 004058D7
                                                                                                                                                                                                                          • ShowWindow.USER32(00030472,00000008), ref: 004058DC
                                                                                                                                                                                                                          • ShowWindow.USER32(00000008), ref: 00405926
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040595A
                                                                                                                                                                                                                          • CreatePopupMenu.USER32 ref: 0040596B
                                                                                                                                                                                                                          • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040597F
                                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 0040599F
                                                                                                                                                                                                                          • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059B8
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F0
                                                                                                                                                                                                                          • OpenClipboard.USER32(00000000), ref: 00405A00
                                                                                                                                                                                                                          • EmptyClipboard.USER32 ref: 00405A06
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A12
                                                                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00405A1C
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A30
                                                                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00405A50
                                                                                                                                                                                                                          • SetClipboardData.USER32(0000000D,00000000), ref: 00405A5B
                                                                                                                                                                                                                          • CloseClipboard.USER32 ref: 00405A61
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                                          • String ID: {
                                                                                                                                                                                                                          • API String ID: 590372296-366298937
                                                                                                                                                                                                                          • Opcode ID: c8ef7bbbe888f33c7642292c9829dc0fe895fcac448e4408b73d3b9779d96911
                                                                                                                                                                                                                          • Instruction ID: 6b97441d6f4cfe62a880681573964a63c423f2dd70b2063085686802d9cc5617
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c8ef7bbbe888f33c7642292c9829dc0fe895fcac448e4408b73d3b9779d96911
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C8B169B1900608FFDB119FA0DD85AAE7B79FB44355F00803AFA41BA1A0C7755E51DF58
                                                                                                                                                                                                                          Function 00405C49 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 148filestringCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 498 405c49-405c6f call 405f14 501 405c71-405c83 DeleteFileW 498->501 502 405c88-405c8f 498->502 503 405e05-405e09 501->503 504 405c91-405c93 502->504 505 405ca2-405cb2 call 40653d 502->505 506 405db3-405db8 504->506 507 405c99-405c9c 504->507 513 405cc1-405cc2 call 405e58 505->513 514 405cb4-405cbf lstrcatW 505->514 506->503 509 405dba-405dbd 506->509 507->505 507->506 511 405dc7-405dcf call 406873 509->511 512 405dbf-405dc5 509->512 511->503 522 405dd1-405de5 call 405e0c call 405c01 511->522 512->503 516 405cc7-405ccb 513->516 514->516 518 405cd7-405cdd lstrcatW 516->518 519 405ccd-405cd5 516->519 521 405ce2-405cfe lstrlenW FindFirstFileW 518->521 519->518 519->521 523 405d04-405d0c 521->523 524 405da8-405dac 521->524 538 405de7-405dea 522->538 539 405dfd-405e00 call 40559f 522->539 526 405d2c-405d40 call 40653d 523->526 527 405d0e-405d16 523->527 524->506 529 405dae 524->529 540 405d42-405d4a 526->540 541 405d57-405d62 call 405c01 526->541 530 405d18-405d20 527->530 531 405d8b-405d9b FindNextFileW 527->531 529->506 530->526 534 405d22-405d2a 530->534 531->523 537 405da1-405da2 FindClose 531->537 534->526 534->531 537->524 538->512 544 405dec-405dfb call 40559f call 4062fd 538->544 539->503 540->531 545 405d4c-405d55 call 405c49 540->545 549 405d83-405d86 call 40559f 541->549 550 405d64-405d67 541->550 544->503 545->531 549->531 553 405d69-405d79 call 40559f call 4062fd 550->553 554 405d7b-405d81 550->554 553->531 554->531
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405C72
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\*.*,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CBA
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\*.*,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CDD
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\*.*,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CE3
                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\*.*,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CF3
                                                                                                                                                                                                                          • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D93
                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00405DA2
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                                          • String ID: .$.$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\*.*$\*.*
                                                                                                                                                                                                                          • API String ID: 2035342205-591817332
                                                                                                                                                                                                                          • Opcode ID: d4824498ca5d4646401654330336f54dc3516ea2401a274e156101c2699109e4
                                                                                                                                                                                                                          • Instruction ID: 8b2ee76931e9ba666d6dc67a471f1b560bbb00ea1adf29c264b32972d7114dcf
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d4824498ca5d4646401654330336f54dc3516ea2401a274e156101c2699109e4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3D41A130900A14BADB216B65CC8DABF7678DF81714F14817FF841B21D1D77C4A819EAE
                                                                                                                                                                                                                          Function 00406873 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(74DF3420,004302B8,C:\,00405F5D,C:\,C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 0040687E
                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 0040688A
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                          • String ID: C:\
                                                                                                                                                                                                                          • API String ID: 2295610775-3404278061
                                                                                                                                                                                                                          • Opcode ID: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
                                                                                                                                                                                                                          • Instruction ID: 67599a3b69382adcf67454a25bfea179debcebd0a6e2e92eb77ede12202c023a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C3D012325192205FC3402B386E0C84B7A989F16331726CB76B4AAF51E0D7388C7387BD
                                                                                                                                                                                                                          Function 00403F9A Relevance: 51.4, APIs: 34, Instructions: 357windowstringCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 192 403f9a-403fac 193 403fb2-403fb8 192->193 194 404113-404122 192->194 193->194 195 403fbe-403fc7 193->195 196 404171-404186 194->196 197 404124-40416c GetDlgItem * 2 call 404499 SetClassLongW call 40140b 194->197 200 403fc9-403fd6 SetWindowPos 195->200 201 403fdc-403fe3 195->201 198 4041c6-4041cb call 4044e5 196->198 199 404188-40418b 196->199 197->196 214 4041d0-4041eb 198->214 203 40418d-404198 call 401389 199->203 204 4041be-4041c0 199->204 200->201 206 403fe5-403fff ShowWindow 201->206 207 404027-40402d 201->207 203->204 228 40419a-4041b9 SendMessageW 203->228 204->198 213 404466 204->213 215 404100-40410e call 404500 206->215 216 404005-404018 GetWindowLongW 206->216 209 404046-404049 207->209 210 40402f-404041 DestroyWindow 207->210 220 40404b-404057 SetWindowLongW 209->220 221 40405c-404062 209->221 217 404443-404449 210->217 219 404468-40446f 213->219 224 4041f4-4041fa 214->224 225 4041ed-4041ef call 40140b 214->225 215->219 216->215 226 40401e-404021 ShowWindow 216->226 217->213 231 40444b-404451 217->231 220->219 221->215 227 404068-404077 GetDlgItem 221->227 232 404200-40420b 224->232 233 404424-40443d DestroyWindow KiUserCallbackDispatcher 224->233 225->224 226->207 235 404096-404099 227->235 236 404079-404090 SendMessageW IsWindowEnabled 227->236 228->219 231->213 237 404453-40445c ShowWindow 231->237 232->233 234 404211-40425e call 40657a call 404499 * 3 GetDlgItem 232->234 233->217 264 404260-404265 234->264 265 404268-4042a4 ShowWindow KiUserCallbackDispatcher call 4044bb KiUserCallbackDispatcher 234->265 239 40409b-40409c 235->239 240 40409e-4040a1 235->240 236->213 236->235 237->213 242 4040cc-4040d1 call 404472 239->242 243 4040a3-4040a9 240->243 244 4040af-4040b4 240->244 242->215 247 4040ea-4040fa SendMessageW 243->247 248 4040ab-4040ad 243->248 244->247 249 4040b6-4040bc 244->249 247->215 248->242 252 4040d3-4040dc call 40140b 249->252 253 4040be-4040c4 call 40140b 249->253 252->215 262 4040de-4040e8 252->262 260 4040ca 253->260 260->242 262->260 264->265 268 4042a6-4042a7 265->268 269 4042a9 265->269 270 4042ab-4042d9 GetSystemMenu EnableMenuItem SendMessageW 268->270 269->270 271 4042db-4042ec SendMessageW 270->271 272 4042ee 270->272 273 4042f4-404333 call 4044ce call 403f7b call 40653d lstrlenW call 40657a SetWindowTextW call 401389 271->273 272->273 273->214 284 404339-40433b 273->284 284->214 285 404341-404345 284->285 286 404364-404378 DestroyWindow 285->286 287 404347-40434d 285->287 286->217 289 40437e-4043ab CreateDialogParamW 286->289 287->213 288 404353-404359 287->288 288->214 290 40435f 288->290 289->217 291 4043b1-404408 call 404499 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 289->291 290->213 291->213 296 40440a-40441d ShowWindow call 4044e5 291->296 298 404422 296->298 298->217
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FD6
                                                                                                                                                                                                                          • ShowWindow.USER32(?), ref: 00403FF6
                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00404008
                                                                                                                                                                                                                          • ShowWindow.USER32(?,00000004), ref: 00404021
                                                                                                                                                                                                                          • DestroyWindow.USER32 ref: 00404035
                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,00000000,00000000), ref: 0040404E
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,?), ref: 0040406D
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404081
                                                                                                                                                                                                                          • IsWindowEnabled.USER32(00000000), ref: 00404088
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000001), ref: 00404133
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000002), ref: 0040413D
                                                                                                                                                                                                                          • SetClassLongW.USER32(?,000000F2,?), ref: 00404157
                                                                                                                                                                                                                          • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A8
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000003), ref: 0040424E
                                                                                                                                                                                                                          • ShowWindow.USER32(00000000,?), ref: 0040426F
                                                                                                                                                                                                                          • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404281
                                                                                                                                                                                                                          • KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040429C
                                                                                                                                                                                                                          • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042B2
                                                                                                                                                                                                                          • EnableMenuItem.USER32(00000000), ref: 004042B9
                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042D1
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042E4
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(0042D268,?,0042D268,00000000), ref: 0040430E
                                                                                                                                                                                                                          • SetWindowTextW.USER32(?,0042D268), ref: 00404322
                                                                                                                                                                                                                          • ShowWindow.USER32(?,0000000A), ref: 00404456
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Window$Item$MessageSendShow$Long$CallbackDispatcherMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3964124867-0
                                                                                                                                                                                                                          • Opcode ID: e7f11a10533a611f3fe78e549378f399a66bd747c21cf404ab37e5123baac86e
                                                                                                                                                                                                                          • Instruction ID: 19e8ffe36521fda3862950d2389d84f1ef0c133ac5ff71005f69e3a94542e2f3
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e7f11a10533a611f3fe78e549378f399a66bd747c21cf404ab37e5123baac86e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DDC1A1B1A00704ABDB206F61EE49E2B3A68FB84746F15053EF741B61F1CB799841DB2D
                                                                                                                                                                                                                          Function 00403BEC Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 299 403bec-403c04 call 40690a 302 403c06-403c16 call 406484 299->302 303 403c18-403c4f call 40640b 299->303 312 403c72-403c9b call 403ec2 call 405f14 302->312 308 403c51-403c62 call 40640b 303->308 309 403c67-403c6d lstrcatW 303->309 308->309 309->312 317 403ca1-403ca6 312->317 318 403d2d-403d35 call 405f14 312->318 317->318 319 403cac-403cd4 call 40640b 317->319 324 403d43-403d68 LoadImageW 318->324 325 403d37-403d3e call 40657a 318->325 319->318 326 403cd6-403cda 319->326 328 403de9-403df1 call 40140b 324->328 329 403d6a-403d9a RegisterClassW 324->329 325->324 330 403cec-403cf8 lstrlenW 326->330 331 403cdc-403ce9 call 405e39 326->331 343 403df3-403df6 328->343 344 403dfb-403e06 call 403ec2 328->344 332 403da0-403de4 SystemParametersInfoW CreateWindowExW 329->332 333 403eb8 329->333 337 403d20-403d28 call 405e0c call 40653d 330->337 338 403cfa-403d08 lstrcmpiW 330->338 331->330 332->328 336 403eba-403ec1 333->336 337->318 338->337 342 403d0a-403d14 GetFileAttributesW 338->342 347 403d16-403d18 342->347 348 403d1a-403d1b call 405e58 342->348 343->336 352 403e0c-403e26 ShowWindow call 40689a 344->352 353 403e8f-403e90 call 405672 344->353 347->337 347->348 348->337 360 403e32-403e44 GetClassInfoW 352->360 361 403e28-403e2d call 40689a 352->361 356 403e95-403e97 353->356 358 403eb1-403eb3 call 40140b 356->358 359 403e99-403e9f 356->359 358->333 359->343 362 403ea5-403eac call 40140b 359->362 365 403e46-403e56 GetClassInfoW RegisterClassW 360->365 366 403e5c-403e7f DialogBoxParamW call 40140b 360->366 361->360 362->343 365->366 370 403e84-403e8d call 403b3c 366->370 370->336
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 0040690A: GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
                                                                                                                                                                                                                            • Part of subcall function 0040690A: GetProcAddress.KERNEL32(00000000,?), ref: 00406937
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403C6D
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420), ref: 00403CED
                                                                                                                                                                                                                          • lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 00403D00
                                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(Remove folder: ,?,00000000,?), ref: 00403D0B
                                                                                                                                                                                                                          • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00440800), ref: 00403D54
                                                                                                                                                                                                                            • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                                                                                                                          • RegisterClassW.USER32(00433EA0), ref: 00403D91
                                                                                                                                                                                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DA9
                                                                                                                                                                                                                          • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DDE
                                                                                                                                                                                                                          • ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403E14
                                                                                                                                                                                                                          • GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403E40
                                                                                                                                                                                                                          • GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403E4D
                                                                                                                                                                                                                          • RegisterClassW.USER32(00433EA0), ref: 00403E56
                                                                                                                                                                                                                          • DialogBoxParamW.USER32(?,00000000,00403F9A,00000000), ref: 00403E75
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                          • String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                                                                                                                                                                                                          • API String ID: 1975747703-1389134667
                                                                                                                                                                                                                          • Opcode ID: b5e4680adf6fab30abf8c31c9b96982c96c1f128c8b6e65fe06ccfbd791f05a2
                                                                                                                                                                                                                          • Instruction ID: 6cc527b2f10929733706d009ff8c1d9b21e511251dd9cb17fe62514cef47010a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b5e4680adf6fab30abf8c31c9b96982c96c1f128c8b6e65fe06ccfbd791f05a2
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F561A670140300BED721AF66ED46F2B3A6CEB84B5AF40453FF945B62E2CB7D59018A6D
                                                                                                                                                                                                                          Function 0040307D Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 181memoryCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 373 40307d-4030cb GetTickCount GetModuleFileNameW call 40602d 376 4030d7-403105 call 40653d call 405e58 call 40653d GetFileSize 373->376 377 4030cd-4030d2 373->377 385 4031f0-4031fe call 403019 376->385 386 40310b 376->386 378 4032ad-4032b1 377->378 392 403200-403203 385->392 393 403253-403258 385->393 388 403110-403127 386->388 390 403129 388->390 391 40312b-403134 call 4034cf 388->391 390->391 399 40325a-403262 call 403019 391->399 400 40313a-403141 391->400 395 403205-40321d call 4034e5 call 4034cf 392->395 396 403227-403251 GlobalAlloc call 4034e5 call 4032b4 392->396 393->378 395->393 419 40321f-403225 395->419 396->393 424 403264-403275 396->424 399->393 404 403143-403157 call 405fe8 400->404 405 4031bd-4031c1 400->405 410 4031cb-4031d1 404->410 422 403159-403160 404->422 409 4031c3-4031ca call 403019 405->409 405->410 409->410 415 4031e0-4031e8 410->415 416 4031d3-4031dd call 4069f7 410->416 415->388 423 4031ee 415->423 416->415 419->393 419->396 422->410 428 403162-403169 422->428 423->385 425 403277 424->425 426 40327d-403282 424->426 425->426 429 403283-403289 426->429 428->410 430 40316b-403172 428->430 429->429 431 40328b-4032a6 SetFilePointer call 405fe8 429->431 430->410 432 403174-40317b 430->432 436 4032ab 431->436 432->410 433 40317d-40319d 432->433 433->393 435 4031a3-4031a7 433->435 437 4031a9-4031ad 435->437 438 4031af-4031b7 435->438 436->378 437->423 437->438 438->410 439 4031b9-4031bb 438->439 439->410
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetTickCount.KERNEL32 ref: 0040308E
                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Setup.exe,00000400,?,?,?,?,?,0040387D,?), ref: 004030AA
                                                                                                                                                                                                                            • Part of subcall function 0040602D: GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                                                                                                                            • Part of subcall function 0040602D: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                                                                                                                          • GetFileSize.KERNEL32(00000000,00000000,00444000,00000000,00441800,00441800,C:\Users\user\Desktop\Setup.exe,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D), ref: 004030F6
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,}8@,?,?,?,?,?,0040387D,?), ref: 0040322C
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\Setup.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$}8@
                                                                                                                                                                                                                          • API String ID: 2803837635-3037081627
                                                                                                                                                                                                                          • Opcode ID: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
                                                                                                                                                                                                                          • Instruction ID: 750c061bb954c4555836cecba7cc54c639b148d890841a972b43b12454d44aa7
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7951B571904204AFDB10AF65ED42B9E7EACAB48756F14807BF904B62D1C77C9F408B9D
                                                                                                                                                                                                                          Function 0040657A Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 196stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 440 40657a-406585 441 406587-406596 440->441 442 406598-4065ae 440->442 441->442 443 4065b0-4065bd 442->443 444 4065c6-4065cf 442->444 443->444 445 4065bf-4065c2 443->445 446 4065d5 444->446 447 4067aa-4067b5 444->447 445->444 448 4065da-4065e7 446->448 449 4067c0-4067c1 447->449 450 4067b7-4067bb call 40653d 447->450 448->447 451 4065ed-4065f6 448->451 450->449 453 406788 451->453 454 4065fc-406639 451->454 457 406796-406799 453->457 458 40678a-406794 453->458 455 40672c-406731 454->455 456 40663f-406646 454->456 462 406733-406739 455->462 463 406764-406769 455->463 459 406648-40664a 456->459 460 40664b-40664d 456->460 461 40679b-4067a4 457->461 458->461 459->460 464 40668a-40668d 460->464 465 40664f-406676 call 40640b 460->465 461->447 468 4065d7 461->468 469 406749-406755 call 40653d 462->469 470 40673b-406747 call 406484 462->470 466 406778-406786 lstrlenW 463->466 467 40676b-406773 call 40657a 463->467 474 40669d-4066a0 464->474 475 40668f-40669b GetSystemDirectoryW 464->475 485 406713-406717 465->485 486 40667c-406685 call 40657a 465->486 466->461 467->466 468->448 478 40675a-406760 469->478 470->478 481 4066a2-4066b0 GetWindowsDirectoryW 474->481 482 406709-40670b 474->482 480 40670d-406711 475->480 478->466 483 406762 478->483 480->485 487 406724-40672a call 4067c4 480->487 481->482 482->480 484 4066b2-4066ba 482->484 483->487 491 4066d1-4066e7 SHGetSpecialFolderLocation 484->491 492 4066bc-4066c5 484->492 485->487 488 406719-40671f lstrcatW 485->488 486->480 487->466 488->487 493 406705 491->493 494 4066e9-406703 SHGetPathFromIDListW CoTaskMemFree 491->494 497 4066cd-4066cf 492->497 493->482 494->480 494->493 497->480 497->491
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetSystemDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 00406695
                                                                                                                                                                                                                          • GetWindowsDirectoryW.KERNEL32(Remove folder: ,00000400,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000,00000000,00424420,74DF23A0), ref: 004066A8
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Directory$SystemWindowslstrcatlstrlen
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\nsb5A9.tmp$Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                                                                          • API String ID: 4260037668-2513457144
                                                                                                                                                                                                                          • Opcode ID: 71c82525ba0a65243e1f04eb87fe478d36a31e86dfe70ef8bf5ce9ddd18f012c
                                                                                                                                                                                                                          • Instruction ID: 685928b229c5d1fd60d609eb920d771e11fa4d776b5b66b0bad6c944a0f90ddf
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 71c82525ba0a65243e1f04eb87fe478d36a31e86dfe70ef8bf5ce9ddd18f012c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1D61D131900205EADB209F64DD80BAE77A5EF54318F22813BE907B72D0D77D99A1CB5D
                                                                                                                                                                                                                          Function 004032B4 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 166COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 562 4032b4-4032cb 563 4032d4-4032dd 562->563 564 4032cd 562->564 565 4032e6-4032eb 563->565 566 4032df 563->566 564->563 567 4032fb-403308 call 4034cf 565->567 568 4032ed-4032f6 call 4034e5 565->568 566->565 572 4034bd 567->572 573 40330e-403312 567->573 568->567 574 4034bf-4034c0 572->574 575 403468-40346a 573->575 576 403318-403361 GetTickCount 573->576 579 4034c8-4034cc 574->579 577 4034aa-4034ad 575->577 578 40346c-40346f 575->578 580 4034c5 576->580 581 403367-40336f 576->581 585 4034b2-4034bb call 4034cf 577->585 586 4034af 577->586 578->580 582 403471 578->582 580->579 583 403371 581->583 584 403374-403382 call 4034cf 581->584 588 403474-40347a 582->588 583->584 584->572 596 403388-403391 584->596 585->572 594 4034c2 585->594 586->585 591 40347c 588->591 592 40347e-40348c call 4034cf 588->592 591->592 592->572 599 40348e-40349a call 4060df 592->599 594->580 598 403397-4033b7 call 406a65 596->598 604 403460-403462 598->604 605 4033bd-4033d0 GetTickCount 598->605 606 403464-403466 599->606 607 40349c-4034a6 599->607 604->574 608 4033d2-4033da 605->608 609 40341b-40341d 605->609 606->574 607->588 614 4034a8 607->614 610 4033e2-403418 MulDiv wsprintfW call 40559f 608->610 611 4033dc-4033e0 608->611 612 403454-403458 609->612 613 40341f-403423 609->613 610->609 611->609 611->610 612->581 618 40345e 612->618 616 403425-40342c call 4060df 613->616 617 40343a-403445 613->617 614->580 622 403431-403433 616->622 621 403448-40344c 617->621 618->580 621->598 623 403452 621->623 622->606 624 403435-403438 622->624 623->580 624->621
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CountTick$wsprintf
                                                                                                                                                                                                                          • String ID: *B$ DB$ A$ A$... %d%%$tClientRect$}8@
                                                                                                                                                                                                                          • API String ID: 551687249-400812307
                                                                                                                                                                                                                          • Opcode ID: 3bb00b159343602b5baf8216f2e6fd7ccfc314744640e4b330e170589aabe739
                                                                                                                                                                                                                          • Instruction ID: 54ab186c05730647c672001b6e56d135182c7b51176e178f40f708a1e84a381e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3bb00b159343602b5baf8216f2e6fd7ccfc314744640e4b330e170589aabe739
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E251BD31810219EBCF11DF65DA44B9E7BB8AF05756F10827BE804BB2C1D7789E44CBA9
                                                                                                                                                                                                                          Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 625 40176f-401794 call 402da6 call 405e83 630 401796-40179c call 40653d 625->630 631 40179e-4017b0 call 40653d call 405e0c lstrcatW 625->631 636 4017b5-4017b6 call 4067c4 630->636 631->636 640 4017bb-4017bf 636->640 641 4017c1-4017cb call 406873 640->641 642 4017f2-4017f5 640->642 649 4017dd-4017ef 641->649 650 4017cd-4017db CompareFileTime 641->650 643 4017f7-4017f8 call 406008 642->643 644 4017fd-401819 call 40602d 642->644 643->644 652 40181b-40181e 644->652 653 40188d-4018b6 call 40559f call 4032b4 644->653 649->642 650->649 654 401820-40185e call 40653d * 2 call 40657a call 40653d call 405b9d 652->654 655 40186f-401879 call 40559f 652->655 665 4018b8-4018bc 653->665 666 4018be-4018ca SetFileTime 653->666 654->640 687 401864-401865 654->687 667 401882-401888 655->667 665->666 669 4018d0-4018db CloseHandle 665->669 666->669 670 402c33 667->670 673 4018e1-4018e4 669->673 674 402c2a-402c2d 669->674 675 402c35-402c39 670->675 677 4018e6-4018f7 call 40657a lstrcatW 673->677 678 4018f9-4018fc call 40657a 673->678 674->670 684 401901-4023a2 call 405b9d 677->684 678->684 684->674 684->675 687->667 689 401867-401868 687->689 689->655
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(00000000,00000000,get,00441000,?,?,00000031), ref: 004017B0
                                                                                                                                                                                                                          • CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,00441000,?,?,00000031), ref: 004017D5
                                                                                                                                                                                                                            • Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A
                                                                                                                                                                                                                            • Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                                                            • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                                                            • Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000,00424420,74DF23A0), ref: 004055FA
                                                                                                                                                                                                                            • Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\), ref: 0040560C
                                                                                                                                                                                                                            • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                                                            • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                                                            • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp$C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\inetc.dll$get
                                                                                                                                                                                                                          • API String ID: 1941528284-891930135
                                                                                                                                                                                                                          • Opcode ID: f7e64eeb5d3c4bf8a05a3440747446d68def3c8d7aa8c7c6583b7de4a42550af
                                                                                                                                                                                                                          • Instruction ID: 1e3f5e060805a06bac003644be00ba5f3fef1f2c353f2d3d357c0a6c5ca497fd
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f7e64eeb5d3c4bf8a05a3440747446d68def3c8d7aa8c7c6583b7de4a42550af
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F4419371900108BACF11BFB5DD85DAE7A79EF45768B20423FF422B10E2D63C8A91966D
                                                                                                                                                                                                                          Function 0040559F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 691 40559f-4055b4 692 4055ba-4055cb 691->692 693 40566b-40566f 691->693 694 4055d6-4055e2 lstrlenW 692->694 695 4055cd-4055d1 call 40657a 692->695 697 4055e4-4055f4 lstrlenW 694->697 698 4055ff-405603 694->698 695->694 697->693 699 4055f6-4055fa lstrcatW 697->699 700 405612-405616 698->700 701 405605-40560c SetWindowTextW 698->701 699->698 702 405618-40565a SendMessageW * 3 700->702 703 40565c-40565e 700->703 701->700 702->703 703->693 704 405660-405663 703->704 704->693
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000,00424420,74DF23A0), ref: 004055FA
                                                                                                                                                                                                                          • SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\), ref: 0040560C
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                                                            • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                            • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSendlstrlen$lstrcat$TextWindow
                                                                                                                                                                                                                          • String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\
                                                                                                                                                                                                                          • API String ID: 1495540970-691184309
                                                                                                                                                                                                                          • Opcode ID: 195069dcc2a5024ac29c7a45bf60c8768b6efe327543dfefb6c4dd5180e0e504
                                                                                                                                                                                                                          • Instruction ID: 138a2a903332092674924c4fce2a37a83712bc812e9b86ab44911e1df8857bb6
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 195069dcc2a5024ac29c7a45bf60c8768b6efe327543dfefb6c4dd5180e0e504
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C1219071900558BACF11AFA9DD84DDFBF75EF45354F14803AF904B22A0C7794A419F68
                                                                                                                                                                                                                          Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 705 4026ec-402705 call 402d84 708 402c2a-402c2d 705->708 709 40270b-402712 705->709 710 402c33-402c39 708->710 711 402714 709->711 712 402717-40271a 709->712 711->712 713 402720-40272f call 40649d 712->713 714 40287e-402886 712->714 713->714 718 402735 713->718 714->708 719 40273b-40273f 718->719 720 4027d4-4027d7 719->720 721 402745-402760 ReadFile 719->721 723 4027d9-4027dc 720->723 724 4027ef-4027ff call 4060b0 720->724 721->714 722 402766-40276b 721->722 722->714 726 402771-40277f 722->726 723->724 727 4027de-4027e9 call 40610e 723->727 724->714 733 402801 724->733 730 402785-402797 MultiByteToWideChar 726->730 731 40283a-402846 call 406484 726->731 727->714 727->724 730->733 734 402799-40279c 730->734 731->710 736 402804-402807 733->736 737 40279e-4027a9 734->737 736->731 739 402809-40280e 736->739 737->736 740 4027ab-4027d0 SetFilePointer MultiByteToWideChar 737->740 741 402810-402815 739->741 742 40284b-40284f 739->742 740->737 743 4027d2 740->743 741->742 746 402817-40282a 741->746 744 402851-402855 742->744 745 40286c-402878 SetFilePointer 742->745 743->733 747 402857-40285b 744->747 748 40285d-40286a 744->748 745->714 746->714 749 40282c-402832 746->749 747->745 747->748 748->714 749->719 750 402838 749->750 750->714
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • ReadFile.KERNEL32(?,?,?,?), ref: 00402758
                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
                                                                                                                                                                                                                          • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC
                                                                                                                                                                                                                            • Part of subcall function 0040610E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406124
                                                                                                                                                                                                                          • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                                                          • String ID: 9
                                                                                                                                                                                                                          • API String ID: 163830602-2366072709
                                                                                                                                                                                                                          • Opcode ID: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
                                                                                                                                                                                                                          • Instruction ID: 36eba916602f65c1f8b814f2f26102ddc75cc08ed25eda7b441ea0696c55e726
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C551E975D00219AADF20EF95CA89AAEBB79FF04304F10817BE541B62D4D7B49D82CB58
                                                                                                                                                                                                                          Function 0040689A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 751 40689a-4068ba GetSystemDirectoryW 752 4068bc 751->752 753 4068be-4068c0 751->753 752->753 754 4068d1-4068d3 753->754 755 4068c2-4068cb 753->755 757 4068d4-406907 wsprintfW LoadLibraryExW 754->757 755->754 756 4068cd-4068cf 755->756 756->757
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
                                                                                                                                                                                                                          • wsprintfW.USER32 ref: 004068EC
                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406900
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                                                          • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                                                                          • API String ID: 2200240437-1946221925
                                                                                                                                                                                                                          • Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
                                                                                                                                                                                                                          • Instruction ID: 21628a1c63ce2f140fdd4d546058f3b0ba52bdb51e88dcb335987c0e659eada7
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D0F0F671511119ABDB10BB64DD0DF9B376CBF00305F10847AA646F10D0EB7CDA68CBA8
                                                                                                                                                                                                                          Function 00405A6E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 758 405a6e-405ab9 CreateDirectoryW 759 405abb-405abd 758->759 760 405abf-405acc GetLastError 758->760 761 405ae6-405ae8 759->761 760->761 762 405ace-405ae2 SetFileSecurityW 760->762 762->759 763 405ae4 GetLastError 762->763 763->761
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00405AC5
                                                                                                                                                                                                                          • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADA
                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00405AE4
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00405A94
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                          • API String ID: 3449924974-3081826266
                                                                                                                                                                                                                          • Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
                                                                                                                                                                                                                          • Instruction ID: 637b0a295f6611997b04f2fb2f8121e2d74ae93851c1d74b8ff7b710bfe1865b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1A010871D04219EAEF019BA0DD84BEFBBB4EB14314F00813AD545B6281E7789648CFE9
                                                                                                                                                                                                                          Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 764 401d81-401d85 765 401d94-401d9a GetDlgItem 764->765 766 401d87-401d92 call 402d84 764->766 767 401da0-401dcc 765->767 766->767 770 401dd7 767->770 771 401dce-401dd5 call 402da6 767->771 773 401ddb-401e31 GetClientRect LoadImageW SendMessageW 770->773 771->773 775 401e33-401e36 773->775 776 401e3f-401e42 773->776 775->776 777 401e38-401e39 DeleteObject 775->777 778 401e48 776->778 779 402c2a-402c39 776->779 777->776 778->779
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,?), ref: 00401D9A
                                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 00401DE5
                                                                                                                                                                                                                          • LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
                                                                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 00401E39
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1849352358-0
                                                                                                                                                                                                                          • Opcode ID: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
                                                                                                                                                                                                                          • Instruction ID: b69f8f45c5cbb28dd5603d9b1d667d2ce3d3910c133b75fee4ecc707c572ca23
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3321F672904119AFCB05DBA4DE45AEEBBB5EF08314F14003AFA45F62A0DB389951DB98
                                                                                                                                                                                                                          Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 782 401c43-401c63 call 402d84 * 2 787 401c65-401c6c call 402da6 782->787 788 401c6f-401c73 782->788 787->788 790 401c75-401c7c call 402da6 788->790 791 401c7f-401c85 788->791 790->791 794 401cd3-401cfd call 402da6 * 2 FindWindowExW 791->794 795 401c87-401ca3 call 402d84 * 2 791->795 805 401d03 794->805 806 401cc3-401cd1 SendMessageW 795->806 807 401ca5-401cc1 SendMessageTimeoutW 795->807 808 401d06-401d09 805->808 806->805 807->808 809 402c2a-402c39 808->809 810 401d0f 808->810 810->809
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$Timeout
                                                                                                                                                                                                                          • String ID: !
                                                                                                                                                                                                                          • API String ID: 1777923405-2657877971
                                                                                                                                                                                                                          • Opcode ID: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
                                                                                                                                                                                                                          • Instruction ID: 549e056fbb7746b1afa8e7352ee9f1cbf83a3633853e14f9ff1f16dc1dd81c22
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 46219C7190420AAFEF05AFA4D94AAAE7BB4FF84304F14453EF601B61D0D7B88941CB98
                                                                                                                                                                                                                          Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp,00000023,00000011,00000002), ref: 004024D5
                                                                                                                                                                                                                          • RegSetValueExW.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp,00000000,00000011,00000002), ref: 00402515
                                                                                                                                                                                                                          • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseValuelstrlen
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp
                                                                                                                                                                                                                          • API String ID: 2655323295-2913043362
                                                                                                                                                                                                                          • Opcode ID: 3f2741e17913f4b3ae47e715a678bc9f1b76d5c80f35dbb4c6e867a5b8f0e772
                                                                                                                                                                                                                          • Instruction ID: a32c4fc66ba480c3aafb49ec1434dbeb720bd0d2787204a1d049ba7b64bbfaa1
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3f2741e17913f4b3ae47e715a678bc9f1b76d5c80f35dbb4c6e867a5b8f0e772
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8B118E71E00119BEEF10AFA5DE49EAEBAB8FF44358F15443AF504F61C1D7B88D40AA58
                                                                                                                                                                                                                          Function 00405F14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A
                                                                                                                                                                                                                            • Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                                                                                                                            • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                                                                                                                            • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405F6D
                                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 00405F7D
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                                          • String ID: C:\$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                          • API String ID: 3248276644-3049482934
                                                                                                                                                                                                                          • Opcode ID: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
                                                                                                                                                                                                                          • Instruction ID: e20fb510edeaf32ba19235dad054e15b0ffac27cf679254cac4fdbc394554759
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E3F0F426119D6226DB22333A5C05EAF0554CE9276475A023BF895B12C5DB3C8A43D8AE
                                                                                                                                                                                                                          Function 0040605C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetTickCount.KERNEL32 ref: 0040607A
                                                                                                                                                                                                                          • GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,?,0040352B,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406095
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CountFileNameTempTick
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                                                          • API String ID: 1716503409-678247507
                                                                                                                                                                                                                          • Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
                                                                                                                                                                                                                          • Instruction ID: cc98cbd97bba9fac9576f26979179aa346a2ab2dc3c85b14509754d74f2b81c3
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CEF09076B40204FBEB00CF69ED05E9EB7BCEB95750F11803AFA05F7140E6B499648768
                                                                                                                                                                                                                          Function 00403B57 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,74DF3420,00000000,C:\Users\user\AppData\Local\Temp\,00403B2F,00403A5E,?), ref: 00403B71
                                                                                                                                                                                                                          • GlobalFree.KERNEL32(?), ref: 00403B78
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00403B57
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Free$GlobalLibrary
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                          • API String ID: 1100898210-3081826266
                                                                                                                                                                                                                          • Opcode ID: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
                                                                                                                                                                                                                          • Instruction ID: 19c5699a9bb8b3376c06320bd1355d3f7d45777e2bc9a3354ca833756e7661a4
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 40E0EC3290212097C7615F55FE08B6E7B78AF49B26F05056AE884BB2628B746D428BDC
                                                                                                                                                                                                                          Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402103
                                                                                                                                                                                                                            • Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                                                            • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                                                            • Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000,00424420,74DF23A0), ref: 004055FA
                                                                                                                                                                                                                            • Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\), ref: 0040560C
                                                                                                                                                                                                                            • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                                                            • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                                                            • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402114
                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 334405425-0
                                                                                                                                                                                                                          • Opcode ID: 0bf0e5e813b2564cc7cfb612efcde4c797e71ce7d2922b3564d4c07743ad1514
                                                                                                                                                                                                                          • Instruction ID: d1cf9917c249e547a3b1759614bc69e8b445b1996c4dbd71fd6f6dd46acd7470
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0bf0e5e813b2564cc7cfb612efcde4c797e71ce7d2922b3564d4c07743ad1514
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2A21C231904104FACF11AFA5CE48A9D7A71BF48358F20413BF605B91E1DBBD8A82965D
                                                                                                                                                                                                                          Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GlobalFree.KERNEL32(00641220), ref: 00401C0B
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,00000804), ref: 00401C1D
                                                                                                                                                                                                                            • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                            • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Global$AllocFreelstrcatlstrlen
                                                                                                                                                                                                                          • String ID: get
                                                                                                                                                                                                                          • API String ID: 3292104215-4248514160
                                                                                                                                                                                                                          • Opcode ID: f7499587b74b1f9cb3fce9f730428132cfcdd1475af0708a05741156e8f6fa82
                                                                                                                                                                                                                          • Instruction ID: 7c0f58a685d1fc6dd3685da305ee1819882fb4420ac17dc2787245939102450a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f7499587b74b1f9cb3fce9f730428132cfcdd1475af0708a05741156e8f6fa82
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1B21D872904210EBDB20AFA8EE84A5E73B4EB04715755063BF552F72D0D7B8AC414B9D
                                                                                                                                                                                                                          Function 0040259E Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
                                                                                                                                                                                                                          • RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E4
                                                                                                                                                                                                                          • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Enum$CloseValue
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 397863658-0
                                                                                                                                                                                                                          • Opcode ID: 89c6ceebaf26a2410158c75cc71a1e3b778611476644ea09d24f59567d4f9c93
                                                                                                                                                                                                                          • Instruction ID: 08080f496e1fbaad801da7c4a2f11cdf7a22a5a493a276a89d416976773fa01e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 89c6ceebaf26a2410158c75cc71a1e3b778611476644ea09d24f59567d4f9c93
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 89017CB1A04105ABEB159F94DE58AAEB66CEF40348F10403AF501B61C0EBB85E44966D
                                                                                                                                                                                                                          Function 00405C01 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00406008: GetFileAttributesW.KERNEL32(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
                                                                                                                                                                                                                            • Part of subcall function 00406008: SetFileAttributesW.KERNEL32(?,00000000), ref: 00406021
                                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405DE3), ref: 00405C1C
                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,?,?,00000000,00405DE3), ref: 00405C24
                                                                                                                                                                                                                          • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405C3C
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1655745494-0
                                                                                                                                                                                                                          • Opcode ID: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
                                                                                                                                                                                                                          • Instruction ID: 0274c5225d47ddc366315f3a2fda4b694ad97aa72442a0e2fcdbaf00fd257d87
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F4E0E53110CF9156E61457309E08F5F2AD8EF86715F05493EF892B10C0CBB848068E6A
                                                                                                                                                                                                                          Function 00404472 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SendMessageW.USER32(00000408,?,00000000,004040D1), ref: 00404490
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                                          • String ID: x
                                                                                                                                                                                                                          • API String ID: 3850602802-2363233923
                                                                                                                                                                                                                          • Opcode ID: 6afabcb65d7cd0472edcecb82606307073186cf957424f1b3ed57c3b76b5cfb8
                                                                                                                                                                                                                          • Instruction ID: 1b38e0d23eed931a714c5b599c5829f4d2050063c4158495342b67dc2c27a344
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6afabcb65d7cd0472edcecb82606307073186cf957424f1b3ed57c3b76b5cfb8
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 10C01271140200EACB004B00DE01F0A7A20B7A0B02F209039F381210B087B05422DB0C
                                                                                                                                                                                                                          Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                                                                                                                            • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                                                                                                                            • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
                                                                                                                                                                                                                            • Part of subcall function 00405A6E: CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,00441000,?,00000000,000000F0), ref: 0040164D
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1892508949-0
                                                                                                                                                                                                                          • Opcode ID: e89a9e6a3f09ade376d0d4b3fd71c203f5cd3ef8be9bd613e1140dffb9deb40c
                                                                                                                                                                                                                          • Instruction ID: 910f9ca0e916fbda017ea5bccd1daba2d9720f9cae8b5c5670dceb894c5ef12e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e89a9e6a3f09ade376d0d4b3fd71c203f5cd3ef8be9bd613e1140dffb9deb40c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3E11D031504110EBCF216FA5CD4099F36A0EF25369B28493BE945B52F1DA3E4A829A8E
                                                                                                                                                                                                                          Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
                                                                                                                                                                                                                          • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseQueryValue
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3356406503-0
                                                                                                                                                                                                                          • Opcode ID: 3fb0128ec3c0afb48f28764f09fc95c95f98cfbd5e462e7a9813c2ba4e742ed8
                                                                                                                                                                                                                          • Instruction ID: 3e5dab0bbcc9b7b4348569693e39c51bc0b27c59e8ea0ed6abb05ebc10b9b344
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3fb0128ec3c0afb48f28764f09fc95c95f98cfbd5e462e7a9813c2ba4e742ed8
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5F116D71900219EADF14DFA4DA589AE77B4FF04345B20443BE401B62C0E7B88A45EB5D
                                                                                                                                                                                                                          Function 00401F12 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00405B63: ShellExecuteExW.SHELL32(?), ref: 00405B72
                                                                                                                                                                                                                            • Part of subcall function 004069B5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069C6
                                                                                                                                                                                                                            • Part of subcall function 004069B5: GetExitCodeProcess.KERNEL32(?,?), ref: 004069E8
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseCodeExecuteExitHandleObjectProcessShellSingleWait
                                                                                                                                                                                                                          • String ID: @
                                                                                                                                                                                                                          • API String ID: 165873841-2766056989
                                                                                                                                                                                                                          • Opcode ID: e9e6b888b2ac62b7866e10c79cc816c8736e15ae282fdec460a2aeb23ba8a534
                                                                                                                                                                                                                          • Instruction ID: 706d8f23dd4fc365793d21c3b3cee38f3579e955c6bce5a1691758ef83551cc9
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e9e6b888b2ac62b7866e10c79cc816c8736e15ae282fdec460a2aeb23ba8a534
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 20115B71E042189ADB50EFB9CA49B8CB6F4BF04304F24447AE405F72C1EBBC89459B18
                                                                                                                                                                                                                          Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3850602802-0
                                                                                                                                                                                                                          • Opcode ID: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
                                                                                                                                                                                                                          • Instruction ID: f98c5e72cab4da6dd47fcf147c12dc0649e5852bd482257a86ca63d172a8b8d6
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0B01F4316202209FE7094B389D05B6A3698E710319F14823FF851F65F1EA78DC029B4C
                                                                                                                                                                                                                          Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • ShowWindow.USER32(00000000,00000000), ref: 00401EFC
                                                                                                                                                                                                                          • EnableWindow.USER32(00000000,00000000), ref: 00401F07
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Window$EnableShow
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1136574915-0
                                                                                                                                                                                                                          • Opcode ID: 5ade1ed26a80a7dd8760c06c43378076533002221f41e68569be4ee1dd8de31a
                                                                                                                                                                                                                          • Instruction ID: ff95e9915c8c9942b49c08d49a5710ecdabad47c7be9b03b7ba0a01474a23479
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5ade1ed26a80a7dd8760c06c43378076533002221f41e68569be4ee1dd8de31a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E7E04872908211CFE705EBA4EE495AD77F4EF40325710497FE501F11D1DBB55D00965D
                                                                                                                                                                                                                          Function 00405B20 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?), ref: 00405B56
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3712363035-0
                                                                                                                                                                                                                          • Opcode ID: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
                                                                                                                                                                                                                          • Instruction ID: 0547baa0b497a95b6ed0e8f273b1969b1ac2c9598ef2001c301bcde660c6e2d6
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3EE092B4600209BFEB10AB64AE49F7B7AACEB04704F004565BA51E61A1DB78E8158A78
                                                                                                                                                                                                                          Function 0040690A Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 00406937
                                                                                                                                                                                                                            • Part of subcall function 0040689A: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
                                                                                                                                                                                                                            • Part of subcall function 0040689A: wsprintfW.USER32 ref: 004068EC
                                                                                                                                                                                                                            • Part of subcall function 0040689A: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406900
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2547128583-0
                                                                                                                                                                                                                          • Opcode ID: 6f78d3fdf53352f122fdb8e7e1f438bdfac4fae158339a91a146711bf240c1a4
                                                                                                                                                                                                                          • Instruction ID: 98bdf7d71c6046f852b78b75196177710d0a141037308efd39b2ac7baa162fea
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6f78d3fdf53352f122fdb8e7e1f438bdfac4fae158339a91a146711bf240c1a4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9FE0867390422066D21196745D44D7773A89B99750306443EF946F2090DB38DC31A76E
                                                                                                                                                                                                                          Function 00402C05 Relevance: 3.0, APIs: 2, Instructions: 21windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000000B,00000001), ref: 00402C14
                                                                                                                                                                                                                          • InvalidateRect.USER32(?), ref: 00402C24
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: InvalidateMessageRectSend
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 909852535-0
                                                                                                                                                                                                                          • Opcode ID: 0509652848a83ac1d7feddac23dc24ced32f84c0220a85d8a6f2313ae5a63aab
                                                                                                                                                                                                                          • Instruction ID: 5efb85e177e5feb05262591b5578bbf68be0fc1facb886aaf0ec985341d6bcc2
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0509652848a83ac1d7feddac23dc24ced32f84c0220a85d8a6f2313ae5a63aab
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CEE08C72700008FFEB01CBA4EE84DAEB779FB40315B00007AF502A00A0D7300D40DA28
                                                                                                                                                                                                                          Function 0040602D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                                                                                                                          • CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: File$AttributesCreate
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 415043291-0
                                                                                                                                                                                                                          • Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
                                                                                                                                                                                                                          • Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15
                                                                                                                                                                                                                          Function 00406008 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
                                                                                                                                                                                                                          • SetFileAttributesW.KERNEL32(?,00000000), ref: 00406021
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: AttributesFile
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3188754299-0
                                                                                                                                                                                                                          • Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                                                          • Instruction ID: c979a2e86073268fb5c10017c0603d576bb262e7e1663e1e1b2ee048d1a5e24b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 34D012725041316FC2102728EF0C89BBF55EF643717014B35F9A5A22F0CB304C638A98
                                                                                                                                                                                                                          Function 00403B12 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(FFFFFFFF,00403A5E,?), ref: 00403B1D
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\, xrefs: 00403B31
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseHandle
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\
                                                                                                                                                                                                                          • API String ID: 2962429428-2292879637
                                                                                                                                                                                                                          • Opcode ID: e86ec88962d2cddd060eb64ec5e150871475ae72b9f2b14f7d4b77a190cc5563
                                                                                                                                                                                                                          • Instruction ID: 74b342ff74dc5917d60848dc34610585f5de2c5243f802b65b47dd8438b48b4d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e86ec88962d2cddd060eb64ec5e150871475ae72b9f2b14f7d4b77a190cc5563
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5EC0123050470056D1646F749E4FE153B64AB4073EB600325B0F9B10F1CB3C5759895D
                                                                                                                                                                                                                          Function 00405AEB Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00405AFF
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1375471231-0
                                                                                                                                                                                                                          • Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
                                                                                                                                                                                                                          • Instruction ID: 33feed20cbbf131019f18849f7ccc9358209a8d33535326e0157453b6049084a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1BC04C30204501AED6105B609E48B177AA4DB50741F16843D6146E41E0DA789455EE2D
                                                                                                                                                                                                                          Function 00402891 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SetFilePointer.KERNEL32(00000000,?,00000000,?,?), ref: 004028AF
                                                                                                                                                                                                                            • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FilePointerwsprintf
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 327478801-0
                                                                                                                                                                                                                          • Opcode ID: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
                                                                                                                                                                                                                          • Instruction ID: a13d1cf18dcce6f7d85bed0b4e0fde0de6b16079219dfacd376ffc086bc6f252
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D3E09271A04105BFDB01EFA5AE499AEB3B8EF44319B10483BF102F00C1DA794D119B2D
                                                                                                                                                                                                                          Function 004063D8 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 00406401
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Create
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2289755597-0
                                                                                                                                                                                                                          • Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                                                          • Instruction ID: ccab944935cfefb85f0e849ce69279fb55db75a3b7fb0960311cd9d36817041a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 04E0E6B2010109BFEF095F90DC0AD7B3B1DE704300F01892EFD06D4091E6B5AD306675
                                                                                                                                                                                                                          Function 004060DF Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • WriteFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403498,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 004060F3
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FileWrite
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3934441357-0
                                                                                                                                                                                                                          • Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                                                          • Instruction ID: d8d859634201a592f38c73999a999f352708a9e59580de02994c407fa40ca669
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FAE08C3220026AABEF109E60DC04AEB3B6CFB00360F014837FA16E7081E270E93087A4
                                                                                                                                                                                                                          Function 004060B0 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • ReadFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E2,00000000,00000000,00403306,000000FF,00000004,00000000,00000000,00000000), ref: 004060C4
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FileRead
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2738559852-0
                                                                                                                                                                                                                          • Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                                                          • Instruction ID: 1583d2e05e1cff28e3594e7db3f0db2d88eef65457287744bb544c492d9958e5
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AEE0EC322502AAABDF10AE65DC04AEB7B6CEB05361F018936FD16E6150E631E92197A4
                                                                                                                                                                                                                          Function 004063AA Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,00406438,?,00000000,?,?,Remove folder: ,?), ref: 004063CE
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Open
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 71445658-0
                                                                                                                                                                                                                          • Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                                                          • Instruction ID: 4361357c0318622cec318f667d88df30c4c29b75262f7bca7234b06b46464da2
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 83D0123210020EBBDF115F91AD01FAB3B5DAB08310F014426FE06E40A1D775D530A764
                                                                                                                                                                                                                          Function 00404499 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                            • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                          • SetDlgItemTextW.USER32(?,?,00000000), ref: 004044B3
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ItemTextlstrcatlstrlen
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 281422827-0
                                                                                                                                                                                                                          • Opcode ID: 686190c6e4e1e5cc0914df72c0c951126eb576f2e70f28df627782bea9933419
                                                                                                                                                                                                                          • Instruction ID: 6ac98b26730712a62f5b3967fa7f39b4c61dbbfa6ef1674fce18da22a1fc1fc0
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 686190c6e4e1e5cc0914df72c0c951126eb576f2e70f28df627782bea9933419
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D3C08C35008200BFD641A714EC42F0FB7A8FFA031AF00C42EB05CA10D1C63494208A2A
                                                                                                                                                                                                                          Function 004044E5 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SendMessageW.USER32(0002046A,00000000,00000000,00000000), ref: 004044F7
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3850602802-0
                                                                                                                                                                                                                          • Opcode ID: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
                                                                                                                                                                                                                          • Instruction ID: 729772cd993a62bf3dcd5a53f5ba0c6067f9c4589e443fe2cdcdd0dddf41cb53
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 74C04CB1740605BADA108B509D45F0677546750701F188429B641A50E0CA74E410D62C
                                                                                                                                                                                                                          Function 00405B63 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • ShellExecuteExW.SHELL32(?), ref: 00405B72
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ExecuteShell
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 587946157-0
                                                                                                                                                                                                                          • Opcode ID: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
                                                                                                                                                                                                                          • Instruction ID: 155326c85e208380d9db810c36285a9e1b4200be200639c8195ffcf147e959ee
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BEC092B2000200EFE301CF80CB09F067BE8AF54306F028068E185DA060C7788840CB29
                                                                                                                                                                                                                          Function 004044CE Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3850602802-0
                                                                                                                                                                                                                          • Opcode ID: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
                                                                                                                                                                                                                          • Instruction ID: f9270ce27bc2d5d500308faa7c43699bdd9cec228278350af1c7ef3a72e6c056
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4FB01235181A00FBDE514B00DE09F857E62F7E4701F058038F341240F0CBB200A4DB08
                                                                                                                                                                                                                          Function 004034E5 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SetFilePointer.KERNEL32(00000000,00000000,00000000,00403242,?,?,?,?,?,?,0040387D,?), ref: 004034F3
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FilePointer
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 973152223-0
                                                                                                                                                                                                                          • Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                                                          • Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D
                                                                                                                                                                                                                          Function 004044BB Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • KiUserCallbackDispatcher.NTDLL(?,00404292), ref: 004044C5
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2492992576-0
                                                                                                                                                                                                                          • Opcode ID: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
                                                                                                                                                                                                                          • Instruction ID: 0db23a64e3c973129ccb7351ad80e5cfa0365495cc8a336c35755b545d17f2be
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 74A00275508601DBDE115B51DF09D057B71A7547017414579A18551034C6314461EB5D
                                                                                                                                                                                                                          Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                                                            • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                                                            • Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000,00424420,74DF23A0), ref: 004055FA
                                                                                                                                                                                                                            • Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\), ref: 0040560C
                                                                                                                                                                                                                            • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                                                            • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                                                            • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                                                            • Part of subcall function 00405B20: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
                                                                                                                                                                                                                            • Part of subcall function 00405B20: CloseHandle.KERNEL32(?), ref: 00405B56
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB
                                                                                                                                                                                                                            • Part of subcall function 004069B5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069C6
                                                                                                                                                                                                                            • Part of subcall function 004069B5: GetExitCodeProcess.KERNEL32(?,?), ref: 004069E8
                                                                                                                                                                                                                            • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2972824698-0
                                                                                                                                                                                                                          • Opcode ID: 11aaa4362747121357e125e8dbb3e446f77891c3c0f7104508ea78bcc2682684
                                                                                                                                                                                                                          • Instruction ID: a015d294fcb9cc4e365613bb9e09bf6e78b00889af70ee47f703a6c6056ea9c8
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 11aaa4362747121357e125e8dbb3e446f77891c3c0f7104508ea78bcc2682684
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2DF09072904112EBCB21BBA59A84EDE76E8DF01318F25403BE102B21D1D77C4E429A6E

                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                          Function 0040498A Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003FB), ref: 004049D9
                                                                                                                                                                                                                          • SetWindowTextW.USER32(00000000,?), ref: 00404A03
                                                                                                                                                                                                                          • SHBrowseForFolderW.SHELL32(?), ref: 00404AB4
                                                                                                                                                                                                                          • CoTaskMemFree.OLE32(00000000), ref: 00404ABF
                                                                                                                                                                                                                          • lstrcmpiW.KERNEL32(Remove folder: ,0042D268,00000000,?,?), ref: 00404AF1
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404AFD
                                                                                                                                                                                                                          • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B0F
                                                                                                                                                                                                                            • Part of subcall function 00405B81: GetDlgItemTextW.USER32(?,?,00000400,00404B46), ref: 00405B94
                                                                                                                                                                                                                            • Part of subcall function 004067C4: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
                                                                                                                                                                                                                            • Part of subcall function 004067C4: CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
                                                                                                                                                                                                                            • Part of subcall function 004067C4: CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
                                                                                                                                                                                                                            • Part of subcall function 004067C4: CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E
                                                                                                                                                                                                                          • GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 00404BD2
                                                                                                                                                                                                                          • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BED
                                                                                                                                                                                                                            • Part of subcall function 00404D46: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
                                                                                                                                                                                                                            • Part of subcall function 00404D46: wsprintfW.USER32 ref: 00404DF0
                                                                                                                                                                                                                            • Part of subcall function 00404D46: SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                          • String ID: A$C:\Users\user\AppData\Local\Temp\nsb5A9.tmp$Remove folder:
                                                                                                                                                                                                                          • API String ID: 2624150263-2090218191
                                                                                                                                                                                                                          • Opcode ID: aac53df244383e2a07a9d2c6e377dc106276e891bc31ab3524a37a2d2ad96109
                                                                                                                                                                                                                          • Instruction ID: a81e8b8b6ddc8ea4f7a7a45a10ce21cc850824e22f7b82fba9ad49fead82d7d1
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: aac53df244383e2a07a9d2c6e377dc106276e891bc31ab3524a37a2d2ad96109
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CBA191B1900208ABDB119FA6DD45AAFB7B8EF84314F10803BF601B62D1D77C9A41CB6D
                                                                                                                                                                                                                          Function 004021AA Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CreateInstance
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 542301482-0
                                                                                                                                                                                                                          • Opcode ID: f0c7f0c58da5b2556a219b4126ec8a5e6c03aa9de5f34d462473648d541e39b0
                                                                                                                                                                                                                          • Instruction ID: 5977cb51530078b600b156af0050786de557c4b464dd586e6a5beaa7a0440451
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f0c7f0c58da5b2556a219b4126ec8a5e6c03aa9de5f34d462473648d541e39b0
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A7411571A00208EFCF40DFE4C989E9D7BB5BF49348B20456AF905EB2D1DB799981CB94
                                                                                                                                                                                                                          Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FileFindFirst
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1974802433-0
                                                                                                                                                                                                                          • Opcode ID: 23bc45f7dafbc09bf3d58dfb9668e04a20f74da7ffae18e0ad0b6f577034eb1d
                                                                                                                                                                                                                          • Instruction ID: 3f6fbcf0fd4d311cdd608d5f72697756ed96b8559223cd5d9f1c4d92bc61f1b3
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 23bc45f7dafbc09bf3d58dfb9668e04a20f74da7ffae18e0ad0b6f577034eb1d
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3CF08271A04105EFD701DBA4ED49AAEB378FF14314F60417BE116F21D0E7B88E159B29
                                                                                                                                                                                                                          Function 00406D85 Relevance: .3, Instructions: 334COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
                                                                                                                                                                                                                          • Instruction ID: 3db1d01f4341fbbb805040525b4c18df43ce82c239752998d09602440244d977
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FEE18A71A0070ADFCB24CF59D880BAABBF5FB44305F15852EE496A72D1D338AA91CF45
                                                                                                                                                                                                                          Function 0040755C Relevance: .3, Instructions: 300COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
                                                                                                                                                                                                                          • Instruction ID: 4d3fc1c80ea15bf86cc2801d6424e98614acddb7a54358772128df9d71e60e61
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C6C14871E042599BCF18CF68C8905EEBBB2BF88314F25866AD85677380D7347941CF95
                                                                                                                                                                                                                          Function 00404F06 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003F9), ref: 00404F1E
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000408), ref: 00404F29
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,?), ref: 00404F73
                                                                                                                                                                                                                          • LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404F8A
                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000FC,00405513), ref: 00404FA3
                                                                                                                                                                                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FB7
                                                                                                                                                                                                                          • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404FC9
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001109,00000002), ref: 00404FDF
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FEB
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FFD
                                                                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 00405000
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040502B
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405037
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D2
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405102
                                                                                                                                                                                                                            • Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001132,00000000,?), ref: 00405116
                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00405144
                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405152
                                                                                                                                                                                                                          • ShowWindow.USER32(?,00000005), ref: 00405162
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000419,00000000,?), ref: 0040525D
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C2
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052D7
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052FB
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040531B
                                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 00405330
                                                                                                                                                                                                                          • GlobalFree.KERNEL32(?), ref: 00405340
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053B9
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001102,?,?), ref: 00405462
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405471
                                                                                                                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 0040549C
                                                                                                                                                                                                                          • ShowWindow.USER32(?,00000000), ref: 004054EA
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003FE), ref: 004054F5
                                                                                                                                                                                                                          • ShowWindow.USER32(00000000), ref: 004054FC
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                                          • String ID: $M$N
                                                                                                                                                                                                                          • API String ID: 2564846305-813528018
                                                                                                                                                                                                                          • Opcode ID: dd942b7cbeaa18c8cf4828e28d43e61687b6a80dcb186ef465745c56d9013c5d
                                                                                                                                                                                                                          • Instruction ID: 669472b6e39b4296dbb294a81ed98d86f32f22d8abeb4cff7518c6a892085abf
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dd942b7cbeaa18c8cf4828e28d43e61687b6a80dcb186ef465745c56d9013c5d
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EF028A70900608EFDB20DFA9DD45AAF7BB5FB84314F10817AE610BA2E0D7799942DF58
                                                                                                                                                                                                                          Function 00404658 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004046F6
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003E8), ref: 0040470A
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404727
                                                                                                                                                                                                                          • GetSysColor.USER32(?), ref: 00404738
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404746
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404754
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(?), ref: 00404759
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404766
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040477B
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,0000040A), ref: 004047D4
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000), ref: 004047DB
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003E8), ref: 00404806
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404849
                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 00404857
                                                                                                                                                                                                                          • SetCursor.USER32(00000000), ref: 0040485A
                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00404873
                                                                                                                                                                                                                          • SetCursor.USER32(00000000), ref: 00404876
                                                                                                                                                                                                                          • SendMessageW.USER32(00000111,00000001,00000000), ref: 004048A5
                                                                                                                                                                                                                          • SendMessageW.USER32(00000010,00000000,00000000), ref: 004048B7
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                                                                                                                                                          • String ID: N$Remove folder:
                                                                                                                                                                                                                          • API String ID: 3103080414-3051863454
                                                                                                                                                                                                                          • Opcode ID: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
                                                                                                                                                                                                                          • Instruction ID: e0aa441e67ff77812dea5cfa76c138b5706349c0d06c8e95e02877fce1cb63d1
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1A61A3B5900209BFDB10AF60DD85E6A7BA9FB44314F00843AFB05B62D0D778A951DF98
                                                                                                                                                                                                                          Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                                          • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                                          • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                                          • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                                          • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                                                          • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                                          • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                                                          • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                                          • DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                                          • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                                          • String ID: F
                                                                                                                                                                                                                          • API String ID: 941294808-1304234792
                                                                                                                                                                                                                          • Opcode ID: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
                                                                                                                                                                                                                          • Instruction ID: e457e53e67a16f607b198c8be77aa7e47a8fd9e6aa67a1a07366d16d1d2d9a76
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0E418B71800209AFCF058FA5DE459AF7FB9FF44315F04802AF991AA1A0C738AA55DFA4
                                                                                                                                                                                                                          Function 00406183 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,0040631E,?,?), ref: 004061BE
                                                                                                                                                                                                                          • GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004061C7
                                                                                                                                                                                                                            • Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
                                                                                                                                                                                                                            • Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4
                                                                                                                                                                                                                          • GetShortPathNameW.KERNEL32(?,00431108,00000400), ref: 004061E4
                                                                                                                                                                                                                          • wsprintfA.USER32 ref: 00406202
                                                                                                                                                                                                                          • GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 0040623D
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 0040624C
                                                                                                                                                                                                                          • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406284
                                                                                                                                                                                                                          • SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062DA
                                                                                                                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 004062EB
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F2
                                                                                                                                                                                                                            • Part of subcall function 0040602D: GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                                                                                                                            • Part of subcall function 0040602D: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                                                                                                                                                          • String ID: %ls=%ls$[Rename]
                                                                                                                                                                                                                          • API String ID: 2171350718-461813615
                                                                                                                                                                                                                          • Opcode ID: 6dbc896bee28fc2cd17c6beb7c7e3b01e9a95bb407788db3ff507c40593cf796
                                                                                                                                                                                                                          • Instruction ID: 71978d88b6039f89b25a0dfa2ffa892efa56fbf884cfe692307f7793e751c739
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6dbc896bee28fc2cd17c6beb7c7e3b01e9a95bb407788db3ff507c40593cf796
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6A314670200716BBD2207B659D48F6B3A6CEF45754F15017EFA42F62C2EA3CA821867D
                                                                                                                                                                                                                          Function 00404500 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000EB), ref: 0040451D
                                                                                                                                                                                                                          • GetSysColor.USER32(00000000), ref: 0040455B
                                                                                                                                                                                                                          • SetTextColor.GDI32(?,00000000), ref: 00404567
                                                                                                                                                                                                                          • SetBkMode.GDI32(?,?), ref: 00404573
                                                                                                                                                                                                                          • GetSysColor.USER32(?), ref: 00404586
                                                                                                                                                                                                                          • SetBkColor.GDI32(?,?), ref: 00404596
                                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 004045B0
                                                                                                                                                                                                                          • CreateBrushIndirect.GDI32(?), ref: 004045BA
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2320649405-0
                                                                                                                                                                                                                          • Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                                                          • Instruction ID: 19446832cb8519ea1938040ed984131457e28e93d0b00b9b4dc42373f0e33a15
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 382177B1500705AFCB31DF68DD08B5BBBF8AF41714B058A2EEA96B22E1C734E944CB54
                                                                                                                                                                                                                          Function 004067C4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
                                                                                                                                                                                                                          • CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
                                                                                                                                                                                                                          • CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
                                                                                                                                                                                                                          • CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Char$Next$Prev
                                                                                                                                                                                                                          • String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                          • API String ID: 589700163-4010320282
                                                                                                                                                                                                                          • Opcode ID: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
                                                                                                                                                                                                                          • Instruction ID: 8e05d213a2b26a47bd0c986db1e6a85e10b5e067f284fb5e9645f7af11a9ce3c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7311862780161295DB313B158C44A77A2A8AF58798F56843FED86B32C1E77C8C9282AD
                                                                                                                                                                                                                          Function 00404E54 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E6F
                                                                                                                                                                                                                          • GetMessagePos.USER32 ref: 00404E77
                                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00404E91
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EA3
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EC9
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                                          • String ID: f
                                                                                                                                                                                                                          • API String ID: 41195575-1993550816
                                                                                                                                                                                                                          • Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                                                          • Instruction ID: 177f1d0b32132a6560496663958852c5fe6f1b23f9da62007dee57caca3d7f28
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 34014C71900219BADB00DBA4DD85BFFBBB8AB54711F10012BBA50B61C0D7B49A058BA5
                                                                                                                                                                                                                          Function 00401E4E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetDC.USER32(?), ref: 00401E51
                                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
                                                                                                                                                                                                                          • MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
                                                                                                                                                                                                                          • ReleaseDC.USER32(?,00000000), ref: 00401E84
                                                                                                                                                                                                                            • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                            • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                          • CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED3
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
                                                                                                                                                                                                                          • String ID: MS Shell Dlg
                                                                                                                                                                                                                          • API String ID: 2584051700-76309092
                                                                                                                                                                                                                          • Opcode ID: 7613f5a947f4bbf8195753a17fba9eaca46e1d6fc564812dac8d5fa739d0f051
                                                                                                                                                                                                                          • Instruction ID: 78b13ae86a0973dc2b43aa2eb6c1af0beb3c1ef463c522f55250376beecb9f8a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7613f5a947f4bbf8195753a17fba9eaca46e1d6fc564812dac8d5fa739d0f051
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7001B571904241EFEB005BB0EE49B9A3FB4BB15301F108A39F541B71D2C7B904458BED
                                                                                                                                                                                                                          Function 00402F93 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
                                                                                                                                                                                                                          • MulDiv.KERNEL32(0002BCFB,00000064,0002E668), ref: 00402FDC
                                                                                                                                                                                                                          • wsprintfW.USER32 ref: 00402FEC
                                                                                                                                                                                                                          • SetWindowTextW.USER32(?,?), ref: 00402FFC
                                                                                                                                                                                                                          • SetDlgItemTextW.USER32(?,00000406,?), ref: 0040300E
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • verifying installer: %d%%, xrefs: 00402FE6
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                                          • String ID: verifying installer: %d%%
                                                                                                                                                                                                                          • API String ID: 1451636040-82062127
                                                                                                                                                                                                                          • Opcode ID: 34baaeb4f482044ab67dd7918236f7f229881b82dd6befd7adca30260b95ec65
                                                                                                                                                                                                                          • Instruction ID: eb17ebabde20c32bd565f0ca98bf5c3c7f8a04474e671541d9d17dad0456e96b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 34baaeb4f482044ab67dd7918236f7f229881b82dd6befd7adca30260b95ec65
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 20014B7064020DABEF209F60DE4AFEA3B79FB04345F008039FA06B51D0DBB999559F69
                                                                                                                                                                                                                          Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
                                                                                                                                                                                                                          • GlobalFree.KERNEL32(?), ref: 00402A06
                                                                                                                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 00402A19
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2667972263-0
                                                                                                                                                                                                                          • Opcode ID: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
                                                                                                                                                                                                                          • Instruction ID: 8fc1a79e9ee36ebd610a2d663d7387b5f1fea8f48d7bc9e01940cd119f3fb53c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5831C271D00124BBCF216FA9CE49DDEBE79AF49364F14023AF450762E0CB794C429BA8
                                                                                                                                                                                                                          Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
                                                                                                                                                                                                                          • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
                                                                                                                                                                                                                          • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseEnum$DeleteValue
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1354259210-0
                                                                                                                                                                                                                          • Opcode ID: 8cb330a57336db5e00a931244e28e0c1e8cbbd051d222c2bd1499622aecedac4
                                                                                                                                                                                                                          • Instruction ID: ca6229ec891c5908b4c2d3bab14ae3db7b9396451d72a40731f1c02386a45f13
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8cb330a57336db5e00a931244e28e0c1e8cbbd051d222c2bd1499622aecedac4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DA215A7150010ABBEF119F90CE89EEF7B7DEB50384F100076F909B21A0D7B49E54AA68
                                                                                                                                                                                                                          Function 00404D46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
                                                                                                                                                                                                                          • wsprintfW.USER32 ref: 00404DF0
                                                                                                                                                                                                                          • SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                                          • String ID: %u.%u%s%s
                                                                                                                                                                                                                          • API String ID: 3540041739-3551169577
                                                                                                                                                                                                                          • Opcode ID: f5c410226751388561f0977026f7bc113d9509f0ffdd9d2834ff72966f8c02b6
                                                                                                                                                                                                                          • Instruction ID: d7f2b51e3f2153b105aad6c1cbcae815e44f670c765de83d30fbb221df5484fa
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f5c410226751388561f0977026f7bc113d9509f0ffdd9d2834ff72966f8c02b6
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AC11D573A041283BDB10656DAC45E9E369CAF81334F254237FA66F21D1EA78D91182E8
                                                                                                                                                                                                                          Function 00405EB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                                                                                                                          • CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                                                                                                                          • CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CharNext
                                                                                                                                                                                                                          • String ID: C:\
                                                                                                                                                                                                                          • API String ID: 3213498283-3404278061
                                                                                                                                                                                                                          • Opcode ID: 389604e099afbb0f1c733809242fd9884b65eb47018f1a61235cb76474637dc7
                                                                                                                                                                                                                          • Instruction ID: b7f7aa27055ddc775a1b47344aef2f77b81fec2ea34db2f3ccdabfa21b6bce3d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 389604e099afbb0f1c733809242fd9884b65eb47018f1a61235cb76474637dc7
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7BF0F631810E1296DB317B548C44E7B97BCEB64354B04843BD741B71C0D3BC8D808BDA
                                                                                                                                                                                                                          Function 00405E0C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E12
                                                                                                                                                                                                                          • CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E1C
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(?,0040A014), ref: 00405E2E
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00405E0C
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                          • API String ID: 2659869361-3081826266
                                                                                                                                                                                                                          • Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                                                          • Instruction ID: 1a595bf39a0a3392b99637bd72bd9cca8666c17676e511d5d4bf90e80f698eee
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A8D0A731101930BAC2127B49EC08DDF62ACAE89340341443BF145B30A4CB7C5E5187FD
                                                                                                                                                                                                                          Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\inetc.dll), ref: 00402695
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: lstrlen
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp$C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\inetc.dll
                                                                                                                                                                                                                          • API String ID: 1659193697-3523084307
                                                                                                                                                                                                                          • Opcode ID: fbd5ee5e4de60feb08ffa62b35b3018c7a91bb86716aa8782bbd76b946f17d50
                                                                                                                                                                                                                          • Instruction ID: edf8e5a6553ae7ef136857fb61bcac29e22bbc78049b19fa22ca3c34260198f3
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fbd5ee5e4de60feb08ffa62b35b3018c7a91bb86716aa8782bbd76b946f17d50
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2611EB71A00215BBCB10BFB18E4AAAE7665AF40744F25443FE002B71C2EAFC8891565E
                                                                                                                                                                                                                          Function 00403019 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • DestroyWindow.USER32(00000000,00000000,004031F7,00000001,?,?,?,?,?,0040387D,?), ref: 0040302C
                                                                                                                                                                                                                          • GetTickCount.KERNEL32 ref: 0040304A
                                                                                                                                                                                                                          • CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 00403067
                                                                                                                                                                                                                          • ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040387D,?), ref: 00403075
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2102729457-0
                                                                                                                                                                                                                          • Opcode ID: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
                                                                                                                                                                                                                          • Instruction ID: 3364d2369d767f53e7c05e99e54cbc9c067443d5da9c9f227d7c3a258cba7bb7
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A9F08270702A20AFC2316F50FE4998B7F68FB44B56741447AF446B15ACCB380DA2CB9D
                                                                                                                                                                                                                          Function 00405513 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • IsWindowVisible.USER32(?), ref: 00405542
                                                                                                                                                                                                                          • CallWindowProcW.USER32(?,?,?,?), ref: 00405593
                                                                                                                                                                                                                            • Part of subcall function 004044E5: SendMessageW.USER32(0002046A,00000000,00000000,00000000), ref: 004044F7
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3748168415-3916222277
                                                                                                                                                                                                                          • Opcode ID: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
                                                                                                                                                                                                                          • Instruction ID: 904a7c61355239921aaa7855b64c86422fca6e8886f64d9e6fcbc6a993ea73ec
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F3017CB1100608BFDF209F11DD80AAB3B27EB84754F50453AFA01762D5D77A8E92DA69
                                                                                                                                                                                                                          Function 0040640B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000000,?,00000000,?,?,Remove folder: ,?,?,00406672,80000002), ref: 00406451
                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,00406672,80000002,Software\Microsoft\Windows\CurrentVersion,Remove folder: ,Remove folder: ,Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsuE7DF.tmp\), ref: 0040645C
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseQueryValue
                                                                                                                                                                                                                          • String ID: Remove folder:
                                                                                                                                                                                                                          • API String ID: 3356406503-1958208860
                                                                                                                                                                                                                          • Opcode ID: a598e195228f1036644e08b1753da052d1713cd74bd9ea8ab147b12b545f69e3
                                                                                                                                                                                                                          • Instruction ID: a8d415a3dc4e4479eaaa65942f717852bb8bd3539c12dad3b2e52d491ce509ba
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a598e195228f1036644e08b1753da052d1713cd74bd9ea8ab147b12b545f69e3
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FB017C72510209AADF21CF51CC09EDB3BB8FB54364F01803AFD5AA6190D738D968DBA8
                                                                                                                                                                                                                          Function 00405F92 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
                                                                                                                                                                                                                          • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FBA
                                                                                                                                                                                                                          • CharNextA.USER32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCB
                                                                                                                                                                                                                          • lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000000.00000002.2023377019.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023357482.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023398253.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023415577.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000000.00000002.2023676198.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 190613189-0
                                                                                                                                                                                                                          • Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
                                                                                                                                                                                                                          • Instruction ID: bd09551308ad338638525116890fdadd4ab1f465f5503068af61de479685a4e4
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 34F0C231604418FFC7029BA5CD0099EBBA8EF06250B2140AAF840FB210D678DE019BA9

                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                          Execution Coverage:20.1%
                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                          Signature Coverage:0%
                                                                                                                                                                                                                          Total number of Nodes:1386
                                                                                                                                                                                                                          Total number of Limit Nodes:31
                                                                                                                                                                                                                          execution_graph 3224 403640 SetErrorMode GetVersionExW 3225 403692 GetVersionExW 3224->3225 3226 4036ca 3224->3226 3225->3226 3227 403723 3226->3227 3228 406a35 5 API calls 3226->3228 3314 4069c5 GetSystemDirectoryW 3227->3314 3228->3227 3230 403739 lstrlenA 3230->3227 3231 403749 3230->3231 3317 406a35 GetModuleHandleA 3231->3317 3234 406a35 5 API calls 3235 403757 3234->3235 3236 406a35 5 API calls 3235->3236 3237 403763 #17 OleInitialize SHGetFileInfoW 3236->3237 3323 406668 lstrcpynW 3237->3323 3240 4037b0 GetCommandLineW 3324 406668 lstrcpynW 3240->3324 3242 4037c2 3325 405f64 3242->3325 3245 4038f7 3246 40390b GetTempPathW 3245->3246 3329 40360f 3246->3329 3248 403923 3250 403927 GetWindowsDirectoryW lstrcatW 3248->3250 3251 40397d DeleteFileW 3248->3251 3249 405f64 CharNextW 3253 4037f9 3249->3253 3254 40360f 12 API calls 3250->3254 3339 4030d0 GetTickCount GetModuleFileNameW 3251->3339 3253->3245 3253->3249 3258 4038f9 3253->3258 3256 403943 3254->3256 3255 403990 3259 403b6c ExitProcess CoUninitialize 3255->3259 3261 403a45 3255->3261 3268 405f64 CharNextW 3255->3268 3256->3251 3257 403947 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3256->3257 3260 40360f 12 API calls 3257->3260 3426 406668 lstrcpynW 3258->3426 3263 403b91 3259->3263 3264 403b7c 3259->3264 3267 403975 3260->3267 3369 403d17 3261->3369 3265 403b99 GetCurrentProcess OpenProcessToken 3263->3265 3266 403c0f ExitProcess 3263->3266 3480 405cc8 3264->3480 3271 403bb0 LookupPrivilegeValueW AdjustTokenPrivileges 3265->3271 3272 403bdf 3265->3272 3267->3251 3267->3259 3283 4039b2 3268->3283 3271->3272 3276 406a35 5 API calls 3272->3276 3273 403a54 3273->3259 3279 403be6 3276->3279 3277 403a1b 3427 40603f 3277->3427 3278 403a5c 3443 405c33 3278->3443 3281 403bfb ExitWindowsEx 3279->3281 3285 403c08 3279->3285 3281->3266 3281->3285 3283->3277 3283->3278 3484 40140b 3285->3484 3288 403a72 lstrcatW 3289 403a7d lstrcatW lstrcmpiW 3288->3289 3289->3273 3290 403a9d 3289->3290 3292 403aa2 3290->3292 3293 403aa9 3290->3293 3446 405b99 CreateDirectoryW 3292->3446 3451 405c16 CreateDirectoryW 3293->3451 3294 403a3a 3442 406668 lstrcpynW 3294->3442 3299 403aae SetCurrentDirectoryW 3300 403ac0 3299->3300 3301 403acb 3299->3301 3454 406668 lstrcpynW 3300->3454 3455 406668 lstrcpynW 3301->3455 3306 403b19 CopyFileW 3310 403ad8 3306->3310 3307 403b63 3309 406428 36 API calls 3307->3309 3309->3273 3310->3307 3311 4066a5 17 API calls 3310->3311 3313 403b4d CloseHandle 3310->3313 3456 4066a5 3310->3456 3473 406428 MoveFileExW 3310->3473 3477 405c4b CreateProcessW 3310->3477 3311->3310 3313->3310 3315 4069e7 wsprintfW LoadLibraryExW 3314->3315 3315->3230 3318 406a51 3317->3318 3319 406a5b GetProcAddress 3317->3319 3320 4069c5 3 API calls 3318->3320 3321 403750 3319->3321 3322 406a57 3320->3322 3321->3234 3322->3319 3322->3321 3323->3240 3324->3242 3326 405f6a 3325->3326 3327 4037e8 CharNextW 3326->3327 3328 405f71 CharNextW 3326->3328 3327->3253 3328->3326 3487 4068ef 3329->3487 3331 403625 3331->3248 3332 40361b 3332->3331 3496 405f37 lstrlenW CharPrevW 3332->3496 3335 405c16 2 API calls 3336 403633 3335->3336 3499 406187 3336->3499 3503 406158 GetFileAttributesW CreateFileW 3339->3503 3341 403113 3368 403120 3341->3368 3504 406668 lstrcpynW 3341->3504 3343 403136 3505 405f83 lstrlenW 3343->3505 3347 403147 GetFileSize 3348 403241 3347->3348 3367 40315e 3347->3367 3510 40302e 3348->3510 3352 403286 GlobalAlloc 3355 40329d 3352->3355 3354 4032de 3356 40302e 32 API calls 3354->3356 3359 406187 2 API calls 3355->3359 3356->3368 3357 403267 3358 4035e2 ReadFile 3357->3358 3360 403272 3358->3360 3362 4032ae CreateFileW 3359->3362 3360->3352 3360->3368 3361 40302e 32 API calls 3361->3367 3363 4032e8 3362->3363 3362->3368 3525 4035f8 SetFilePointer 3363->3525 3365 4032f6 3526 403371 3365->3526 3367->3348 3367->3354 3367->3361 3367->3368 3541 4035e2 3367->3541 3368->3255 3370 406a35 5 API calls 3369->3370 3371 403d2b 3370->3371 3372 403d31 3371->3372 3373 403d43 3371->3373 3596 4065af wsprintfW 3372->3596 3597 406536 3373->3597 3377 403d92 lstrcatW 3378 403d41 3377->3378 3588 403fed 3378->3588 3379 406536 3 API calls 3379->3377 3382 40603f 18 API calls 3383 403dc4 3382->3383 3384 403e58 3383->3384 3386 406536 3 API calls 3383->3386 3385 40603f 18 API calls 3384->3385 3387 403e5e 3385->3387 3393 403df6 3386->3393 3388 403e6e LoadImageW 3387->3388 3389 4066a5 17 API calls 3387->3389 3390 403f14 3388->3390 3391 403e95 RegisterClassW 3388->3391 3389->3388 3395 40140b 2 API calls 3390->3395 3394 403ecb SystemParametersInfoW CreateWindowExW 3391->3394 3424 403f1e 3391->3424 3392 403e17 lstrlenW 3397 403e25 lstrcmpiW 3392->3397 3398 403e4b 3392->3398 3393->3384 3393->3392 3396 405f64 CharNextW 3393->3396 3394->3390 3399 403f1a 3395->3399 3400 403e14 3396->3400 3397->3398 3401 403e35 GetFileAttributesW 3397->3401 3402 405f37 3 API calls 3398->3402 3404 403fed 18 API calls 3399->3404 3399->3424 3400->3392 3403 403e41 3401->3403 3405 403e51 3402->3405 3403->3398 3406 405f83 2 API calls 3403->3406 3407 403f2b 3404->3407 3602 406668 lstrcpynW 3405->3602 3406->3398 3409 403f37 ShowWindow 3407->3409 3410 403fba 3407->3410 3411 4069c5 3 API calls 3409->3411 3603 40579d OleInitialize 3410->3603 3413 403f4f 3411->3413 3415 403f5d GetClassInfoW 3413->3415 3418 4069c5 3 API calls 3413->3418 3414 403fc0 3416 403fc4 3414->3416 3417 403fdc 3414->3417 3420 403f71 GetClassInfoW RegisterClassW 3415->3420 3421 403f87 DialogBoxParamW 3415->3421 3422 40140b 2 API calls 3416->3422 3416->3424 3419 40140b 2 API calls 3417->3419 3418->3415 3419->3424 3420->3421 3423 40140b 2 API calls 3421->3423 3422->3424 3425 403faf 3423->3425 3424->3273 3425->3424 3426->3246 3625 406668 lstrcpynW 3427->3625 3429 406050 3626 405fe2 CharNextW CharNextW 3429->3626 3432 403a27 3432->3259 3441 406668 lstrcpynW 3432->3441 3433 4068ef 5 API calls 3439 406066 3433->3439 3434 406097 lstrlenW 3435 4060a2 3434->3435 3434->3439 3436 405f37 3 API calls 3435->3436 3438 4060a7 GetFileAttributesW 3436->3438 3438->3432 3439->3432 3439->3434 3440 405f83 2 API calls 3439->3440 3632 40699e FindFirstFileW 3439->3632 3440->3434 3441->3294 3442->3261 3444 406a35 5 API calls 3443->3444 3445 403a61 lstrcatW 3444->3445 3445->3288 3445->3289 3447 403aa7 3446->3447 3448 405bea GetLastError 3446->3448 3447->3299 3448->3447 3449 405bf9 SetFileSecurityW 3448->3449 3449->3447 3450 405c0f GetLastError 3449->3450 3450->3447 3452 405c2a GetLastError 3451->3452 3453 405c26 3451->3453 3452->3453 3453->3299 3454->3301 3455->3310 3460 4066b2 3456->3460 3457 4068d5 3458 403b0d DeleteFileW 3457->3458 3637 406668 lstrcpynW 3457->3637 3458->3306 3458->3310 3460->3457 3461 4068a3 lstrlenW 3460->3461 3462 4067ba GetSystemDirectoryW 3460->3462 3465 406536 3 API calls 3460->3465 3466 4066a5 10 API calls 3460->3466 3467 4067cd GetWindowsDirectoryW 3460->3467 3468 406844 lstrcatW 3460->3468 3469 4066a5 10 API calls 3460->3469 3470 4068ef 5 API calls 3460->3470 3471 4067fc SHGetSpecialFolderLocation 3460->3471 3635 4065af wsprintfW 3460->3635 3636 406668 lstrcpynW 3460->3636 3461->3460 3462->3460 3465->3460 3466->3461 3467->3460 3468->3460 3469->3460 3470->3460 3471->3460 3472 406814 SHGetPathFromIDListW CoTaskMemFree 3471->3472 3472->3460 3474 406449 3473->3474 3475 40643c 3473->3475 3474->3310 3638 4062ae 3475->3638 3478 405c8a 3477->3478 3479 405c7e CloseHandle 3477->3479 3478->3310 3479->3478 3483 405cdd 3480->3483 3481 403b89 ExitProcess 3482 405cf1 MessageBoxIndirectW 3482->3481 3483->3481 3483->3482 3485 401389 2 API calls 3484->3485 3486 401420 3485->3486 3486->3266 3488 4068fc 3487->3488 3490 406972 3488->3490 3491 406965 CharNextW 3488->3491 3493 405f64 CharNextW 3488->3493 3494 406951 CharNextW 3488->3494 3495 406960 CharNextW 3488->3495 3489 406977 CharPrevW 3489->3490 3490->3489 3492 406998 3490->3492 3491->3488 3491->3490 3492->3332 3493->3488 3494->3488 3495->3491 3497 405f53 lstrcatW 3496->3497 3498 40362d 3496->3498 3497->3498 3498->3335 3500 406194 GetTickCount GetTempFileNameW 3499->3500 3501 40363e 3500->3501 3502 4061ca 3500->3502 3501->3248 3502->3500 3502->3501 3503->3341 3504->3343 3506 405f91 3505->3506 3507 40313c 3506->3507 3508 405f97 CharPrevW 3506->3508 3509 406668 lstrcpynW 3507->3509 3508->3506 3508->3507 3509->3347 3511 403057 3510->3511 3512 40303f 3510->3512 3514 403067 GetTickCount 3511->3514 3515 40305f 3511->3515 3513 403048 DestroyWindow 3512->3513 3518 40304f 3512->3518 3513->3518 3517 403075 3514->3517 3514->3518 3545 406a71 3515->3545 3519 4030aa CreateDialogParamW ShowWindow 3517->3519 3520 40307d 3517->3520 3518->3352 3518->3368 3544 4035f8 SetFilePointer 3518->3544 3519->3518 3520->3518 3549 403012 3520->3549 3522 40308b wsprintfW 3552 4056ca 3522->3552 3525->3365 3527 403380 SetFilePointer 3526->3527 3528 40339c 3526->3528 3527->3528 3563 403479 GetTickCount 3528->3563 3533 403479 42 API calls 3534 4033d3 3533->3534 3535 40343f ReadFile 3534->3535 3539 4033e2 3534->3539 3540 403439 3534->3540 3535->3540 3537 4061db ReadFile 3537->3539 3539->3537 3539->3540 3578 40620a WriteFile 3539->3578 3540->3368 3542 4061db ReadFile 3541->3542 3543 4035f5 3542->3543 3543->3367 3544->3357 3546 406a8e PeekMessageW 3545->3546 3547 406a84 DispatchMessageW 3546->3547 3548 406a9e 3546->3548 3547->3546 3548->3518 3550 403021 3549->3550 3551 403023 MulDiv 3549->3551 3550->3551 3551->3522 3553 4056e5 3552->3553 3554 4030a8 3552->3554 3555 405701 lstrlenW 3553->3555 3556 4066a5 17 API calls 3553->3556 3554->3518 3557 40572a 3555->3557 3558 40570f lstrlenW 3555->3558 3556->3555 3559 405730 SetWindowTextW 3557->3559 3560 40573d 3557->3560 3558->3554 3561 405721 lstrcatW 3558->3561 3559->3560 3560->3554 3562 405743 SendMessageW SendMessageW SendMessageW 3560->3562 3561->3557 3562->3554 3564 4035d1 3563->3564 3565 4034a7 3563->3565 3566 40302e 32 API calls 3564->3566 3580 4035f8 SetFilePointer 3565->3580 3573 4033a3 3566->3573 3568 4034b2 SetFilePointer 3572 4034d7 3568->3572 3569 4035e2 ReadFile 3569->3572 3571 40302e 32 API calls 3571->3572 3572->3569 3572->3571 3572->3573 3574 40620a WriteFile 3572->3574 3575 4035b2 SetFilePointer 3572->3575 3581 406bb0 3572->3581 3573->3540 3576 4061db ReadFile 3573->3576 3574->3572 3575->3564 3577 4033bc 3576->3577 3577->3533 3577->3540 3579 406228 3578->3579 3579->3539 3580->3568 3582 406bd5 3581->3582 3583 406bdd 3581->3583 3582->3572 3583->3582 3584 406c64 GlobalFree 3583->3584 3585 406c6d GlobalAlloc 3583->3585 3586 406ce4 GlobalAlloc 3583->3586 3587 406cdb GlobalFree 3583->3587 3584->3585 3585->3582 3585->3583 3586->3582 3586->3583 3587->3586 3589 404001 3588->3589 3610 4065af wsprintfW 3589->3610 3591 404072 3611 4040a6 3591->3611 3593 403da2 3593->3382 3594 404077 3594->3593 3595 4066a5 17 API calls 3594->3595 3595->3594 3596->3378 3614 4064d5 3597->3614 3600 403d73 3600->3377 3600->3379 3601 40656a RegQueryValueExW RegCloseKey 3601->3600 3602->3384 3618 404610 3603->3618 3605 4057e7 3606 404610 SendMessageW 3605->3606 3608 4057f9 OleUninitialize 3606->3608 3607 4057c0 3607->3605 3621 401389 3607->3621 3608->3414 3610->3591 3612 4066a5 17 API calls 3611->3612 3613 4040b4 SetWindowTextW 3612->3613 3613->3594 3615 4064e4 3614->3615 3616 4064e8 3615->3616 3617 4064ed RegOpenKeyExW 3615->3617 3616->3600 3616->3601 3617->3616 3619 404628 3618->3619 3620 404619 SendMessageW 3618->3620 3619->3607 3620->3619 3623 401390 3621->3623 3622 4013fe 3622->3607 3623->3622 3624 4013cb MulDiv SendMessageW 3623->3624 3624->3623 3625->3429 3627 405fff 3626->3627 3629 406011 3626->3629 3628 40600c CharNextW 3627->3628 3627->3629 3631 406035 3628->3631 3630 405f64 CharNextW 3629->3630 3629->3631 3630->3629 3631->3432 3631->3433 3633 4069b4 FindClose 3632->3633 3634 4069bf 3632->3634 3633->3634 3634->3439 3635->3460 3636->3460 3637->3458 3639 406304 GetShortPathNameW 3638->3639 3640 4062de 3638->3640 3641 406423 3639->3641 3642 406319 3639->3642 3665 406158 GetFileAttributesW CreateFileW 3640->3665 3641->3474 3642->3641 3644 406321 wsprintfA 3642->3644 3646 4066a5 17 API calls 3644->3646 3645 4062e8 CloseHandle GetShortPathNameW 3645->3641 3647 4062fc 3645->3647 3648 406349 3646->3648 3647->3639 3647->3641 3666 406158 GetFileAttributesW CreateFileW 3648->3666 3650 406356 3650->3641 3651 406365 GetFileSize GlobalAlloc 3650->3651 3652 406387 3651->3652 3653 40641c CloseHandle 3651->3653 3654 4061db ReadFile 3652->3654 3653->3641 3655 40638f 3654->3655 3655->3653 3667 4060bd lstrlenA 3655->3667 3658 4063a6 lstrcpyA 3661 4063c8 3658->3661 3659 4063ba 3660 4060bd 4 API calls 3659->3660 3660->3661 3662 4063ff SetFilePointer 3661->3662 3663 40620a WriteFile 3662->3663 3664 406415 GlobalFree 3663->3664 3664->3653 3665->3645 3666->3650 3668 4060fe lstrlenA 3667->3668 3669 406106 3668->3669 3670 4060d7 lstrcmpiA 3668->3670 3669->3658 3669->3659 3670->3669 3671 4060f5 CharNextA 3670->3671 3671->3668 3672 401941 3673 401943 3672->3673 3678 402da6 3673->3678 3679 402db2 3678->3679 3680 4066a5 17 API calls 3679->3680 3681 402dd3 3680->3681 3682 401948 3681->3682 3683 4068ef 5 API calls 3681->3683 3684 405d74 3682->3684 3683->3682 3685 40603f 18 API calls 3684->3685 3686 405d94 3685->3686 3687 405d9c DeleteFileW 3686->3687 3688 405db3 3686->3688 3692 401951 3687->3692 3689 405ed3 3688->3689 3720 406668 lstrcpynW 3688->3720 3689->3692 3696 40699e 2 API calls 3689->3696 3691 405dd9 3693 405dec 3691->3693 3694 405ddf lstrcatW 3691->3694 3695 405f83 2 API calls 3693->3695 3697 405df2 3694->3697 3695->3697 3699 405ef8 3696->3699 3698 405e02 lstrcatW 3697->3698 3700 405e0d lstrlenW FindFirstFileW 3697->3700 3698->3700 3699->3692 3701 405f37 3 API calls 3699->3701 3700->3689 3718 405e2f 3700->3718 3702 405f02 3701->3702 3704 405d2c 5 API calls 3702->3704 3703 405eb6 FindNextFileW 3707 405ecc FindClose 3703->3707 3703->3718 3706 405f0e 3704->3706 3708 405f12 3706->3708 3709 405f28 3706->3709 3707->3689 3708->3692 3712 4056ca 24 API calls 3708->3712 3711 4056ca 24 API calls 3709->3711 3711->3692 3714 405f1f 3712->3714 3713 405d74 60 API calls 3713->3718 3716 406428 36 API calls 3714->3716 3715 4056ca 24 API calls 3715->3703 3716->3692 3717 4056ca 24 API calls 3717->3718 3718->3703 3718->3713 3718->3715 3718->3717 3719 406428 36 API calls 3718->3719 3721 406668 lstrcpynW 3718->3721 3722 405d2c 3718->3722 3719->3718 3720->3691 3721->3718 3730 406133 GetFileAttributesW 3722->3730 3725 405d47 RemoveDirectoryW 3728 405d55 3725->3728 3726 405d4f DeleteFileW 3726->3728 3727 405d59 3727->3718 3728->3727 3729 405d65 SetFileAttributesW 3728->3729 3729->3727 3731 405d38 3730->3731 3732 406145 SetFileAttributesW 3730->3732 3731->3725 3731->3726 3731->3727 3732->3731 3733 4015c1 3734 402da6 17 API calls 3733->3734 3735 4015c8 3734->3735 3736 405fe2 4 API calls 3735->3736 3748 4015d1 3736->3748 3737 401631 3738 401663 3737->3738 3739 401636 3737->3739 3743 401423 24 API calls 3738->3743 3752 401423 3739->3752 3740 405f64 CharNextW 3740->3748 3749 40165b 3743->3749 3745 405c16 2 API calls 3745->3748 3746 405c33 5 API calls 3746->3748 3747 40164a SetCurrentDirectoryW 3747->3749 3748->3737 3748->3740 3748->3745 3748->3746 3750 401617 GetFileAttributesW 3748->3750 3751 405b99 4 API calls 3748->3751 3750->3748 3751->3748 3753 4056ca 24 API calls 3752->3753 3754 401431 3753->3754 3755 406668 lstrcpynW 3754->3755 3755->3747 3992 401c43 3993 402d84 17 API calls 3992->3993 3994 401c4a 3993->3994 3995 402d84 17 API calls 3994->3995 3996 401c57 3995->3996 3997 402da6 17 API calls 3996->3997 3998 401c6c 3996->3998 3997->3998 3999 401c7c 3998->3999 4000 402da6 17 API calls 3998->4000 4001 401cd3 3999->4001 4002 401c87 3999->4002 4000->3999 4004 402da6 17 API calls 4001->4004 4003 402d84 17 API calls 4002->4003 4006 401c8c 4003->4006 4005 401cd8 4004->4005 4007 402da6 17 API calls 4005->4007 4008 402d84 17 API calls 4006->4008 4009 401ce1 FindWindowExW 4007->4009 4010 401c98 4008->4010 4013 401d03 4009->4013 4011 401cc3 SendMessageW 4010->4011 4012 401ca5 SendMessageTimeoutW 4010->4012 4011->4013 4012->4013 4021 4028c4 4022 4028ca 4021->4022 4023 4028d2 FindClose 4022->4023 4024 402c2a 4022->4024 4023->4024 4025 4040c5 4026 4040dd 4025->4026 4027 40423e 4025->4027 4026->4027 4028 4040e9 4026->4028 4029 40424f GetDlgItem GetDlgItem 4027->4029 4034 40428f 4027->4034 4031 4040f4 SetWindowPos 4028->4031 4032 404107 4028->4032 4113 4045c4 4029->4113 4030 4042e9 4035 404610 SendMessageW 4030->4035 4043 404239 4030->4043 4031->4032 4036 404110 ShowWindow 4032->4036 4037 404152 4032->4037 4034->4030 4042 401389 2 API calls 4034->4042 4065 4042fb 4035->4065 4044 404130 GetWindowLongW 4036->4044 4045 4041fc 4036->4045 4039 404171 4037->4039 4040 40415a DestroyWindow 4037->4040 4038 404279 SetClassLongW 4041 40140b 2 API calls 4038->4041 4047 404176 SetWindowLongW 4039->4047 4048 404187 4039->4048 4046 40454d 4040->4046 4041->4034 4049 4042c1 4042->4049 4044->4045 4051 404149 ShowWindow 4044->4051 4099 40462b 4045->4099 4046->4043 4058 40457e ShowWindow 4046->4058 4047->4043 4048->4045 4052 404193 GetDlgItem 4048->4052 4049->4030 4053 4042c5 SendMessageW 4049->4053 4051->4037 4056 4041c1 4052->4056 4057 4041a4 SendMessageW IsWindowEnabled 4052->4057 4053->4043 4054 40140b 2 API calls 4054->4065 4055 40454f DestroyWindow EndDialog 4055->4046 4060 4041ce 4056->4060 4063 404215 SendMessageW 4056->4063 4064 4041e1 4056->4064 4070 4041c6 4056->4070 4057->4043 4057->4056 4058->4043 4059 4066a5 17 API calls 4059->4065 4060->4063 4060->4070 4062 4045c4 18 API calls 4062->4065 4063->4045 4066 4041e9 4064->4066 4067 4041fe 4064->4067 4065->4043 4065->4054 4065->4055 4065->4059 4065->4062 4071 4045c4 18 API calls 4065->4071 4087 40448f DestroyWindow 4065->4087 4069 40140b 2 API calls 4066->4069 4068 40140b 2 API calls 4067->4068 4068->4070 4069->4070 4070->4045 4096 40459d 4070->4096 4072 404376 GetDlgItem 4071->4072 4073 404393 ShowWindow EnableWindow 4072->4073 4074 40438b 4072->4074 4116 4045e6 EnableWindow 4073->4116 4074->4073 4076 4043bd EnableWindow 4081 4043d1 4076->4081 4077 4043d6 GetSystemMenu EnableMenuItem SendMessageW 4078 404406 SendMessageW 4077->4078 4077->4081 4078->4081 4080 4040a6 18 API calls 4080->4081 4081->4077 4081->4080 4117 4045f9 SendMessageW 4081->4117 4118 406668 lstrcpynW 4081->4118 4083 404435 lstrlenW 4084 4066a5 17 API calls 4083->4084 4085 40444b SetWindowTextW 4084->4085 4086 401389 2 API calls 4085->4086 4086->4065 4087->4046 4088 4044a9 CreateDialogParamW 4087->4088 4088->4046 4089 4044dc 4088->4089 4090 4045c4 18 API calls 4089->4090 4091 4044e7 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4090->4091 4092 401389 2 API calls 4091->4092 4093 40452d 4092->4093 4093->4043 4094 404535 ShowWindow 4093->4094 4095 404610 SendMessageW 4094->4095 4095->4046 4097 4045a4 4096->4097 4098 4045aa SendMessageW 4096->4098 4097->4098 4098->4045 4100 4046ee 4099->4100 4101 404643 GetWindowLongW 4099->4101 4100->4043 4101->4100 4102 404658 4101->4102 4102->4100 4103 404685 GetSysColor 4102->4103 4104 404688 4102->4104 4103->4104 4105 404698 SetBkMode 4104->4105 4106 40468e SetTextColor 4104->4106 4107 4046b0 GetSysColor 4105->4107 4108 4046b6 4105->4108 4106->4105 4107->4108 4109 4046c7 4108->4109 4110 4046bd SetBkColor 4108->4110 4109->4100 4111 4046e1 CreateBrushIndirect 4109->4111 4112 4046da DeleteObject 4109->4112 4110->4109 4111->4100 4112->4111 4114 4066a5 17 API calls 4113->4114 4115 4045cf SetDlgItemTextW 4114->4115 4115->4038 4116->4076 4117->4081 4118->4083 4122 4016cc 4123 402da6 17 API calls 4122->4123 4124 4016d2 GetFullPathNameW 4123->4124 4125 4016ec 4124->4125 4131 40170e 4124->4131 4127 40699e 2 API calls 4125->4127 4125->4131 4126 401723 GetShortPathNameW 4128 402c2a 4126->4128 4129 4016fe 4127->4129 4129->4131 4132 406668 lstrcpynW 4129->4132 4131->4126 4131->4128 4132->4131 4133 401e4e GetDC 4134 402d84 17 API calls 4133->4134 4135 401e60 GetDeviceCaps MulDiv ReleaseDC 4134->4135 4136 402d84 17 API calls 4135->4136 4137 401e91 4136->4137 4138 4066a5 17 API calls 4137->4138 4139 401ece CreateFontIndirectW 4138->4139 4140 402638 4139->4140 4140->4140 3896 402950 3897 402da6 17 API calls 3896->3897 3899 40295c 3897->3899 3898 402972 3901 406133 2 API calls 3898->3901 3899->3898 3900 402da6 17 API calls 3899->3900 3900->3898 3902 402978 3901->3902 3924 406158 GetFileAttributesW CreateFileW 3902->3924 3904 402985 3905 402a3b 3904->3905 3906 4029a0 GlobalAlloc 3904->3906 3907 402a23 3904->3907 3908 402a42 DeleteFileW 3905->3908 3909 402a55 3905->3909 3906->3907 3910 4029b9 3906->3910 3911 403371 44 API calls 3907->3911 3908->3909 3925 4035f8 SetFilePointer 3910->3925 3913 402a30 CloseHandle 3911->3913 3913->3905 3914 4029bf 3915 4035e2 ReadFile 3914->3915 3916 4029c8 GlobalAlloc 3915->3916 3917 4029d8 3916->3917 3918 402a0c 3916->3918 3919 403371 44 API calls 3917->3919 3920 40620a WriteFile 3918->3920 3923 4029e5 3919->3923 3921 402a18 GlobalFree 3920->3921 3921->3907 3922 402a03 GlobalFree 3922->3918 3923->3922 3924->3904 3925->3914 4148 403cd5 4149 403ce0 4148->4149 4150 403ce4 4149->4150 4151 403ce7 GlobalAlloc 4149->4151 4151->4150 4152 401956 4153 402da6 17 API calls 4152->4153 4154 40195d lstrlenW 4153->4154 4155 402638 4154->4155 4156 4014d7 4157 402d84 17 API calls 4156->4157 4158 4014dd Sleep 4157->4158 4160 402c2a 4158->4160 3926 4020d8 3927 4020ea 3926->3927 3937 40219c 3926->3937 3928 402da6 17 API calls 3927->3928 3929 4020f1 3928->3929 3931 402da6 17 API calls 3929->3931 3930 401423 24 API calls 3933 4022f6 3930->3933 3932 4020fa 3931->3932 3934 402110 LoadLibraryExW 3932->3934 3935 402102 GetModuleHandleW 3932->3935 3936 402121 3934->3936 3934->3937 3935->3934 3935->3936 3946 406aa4 3936->3946 3937->3930 3940 402132 3943 401423 24 API calls 3940->3943 3944 402142 3940->3944 3941 40216b 3942 4056ca 24 API calls 3941->3942 3942->3944 3943->3944 3944->3933 3945 40218e FreeLibrary 3944->3945 3945->3933 3951 40668a WideCharToMultiByte 3946->3951 3948 406ac1 3949 406ac8 GetProcAddress 3948->3949 3950 40212c 3948->3950 3949->3950 3950->3940 3950->3941 3951->3948 4161 402b59 4162 402b60 4161->4162 4163 402bab 4161->4163 4165 402ba9 4162->4165 4167 402d84 17 API calls 4162->4167 4164 406a35 5 API calls 4163->4164 4166 402bb2 4164->4166 4168 402da6 17 API calls 4166->4168 4169 402b6e 4167->4169 4170 402bbb 4168->4170 4171 402d84 17 API calls 4169->4171 4170->4165 4172 402bbf IIDFromString 4170->4172 4174 402b7a 4171->4174 4172->4165 4173 402bce 4172->4173 4173->4165 4179 406668 lstrcpynW 4173->4179 4178 4065af wsprintfW 4174->4178 4177 402beb CoTaskMemFree 4177->4165 4178->4165 4179->4177 4180 402a5b 4181 402d84 17 API calls 4180->4181 4182 402a61 4181->4182 4183 402aa4 4182->4183 4184 402a88 4182->4184 4189 40292e 4182->4189 4186 402abe 4183->4186 4187 402aae 4183->4187 4185 402a8d 4184->4185 4193 402a9e 4184->4193 4194 406668 lstrcpynW 4185->4194 4188 4066a5 17 API calls 4186->4188 4190 402d84 17 API calls 4187->4190 4188->4193 4190->4193 4193->4189 4195 4065af wsprintfW 4193->4195 4194->4189 4195->4189 3975 40175c 3976 402da6 17 API calls 3975->3976 3977 401763 3976->3977 3978 406187 2 API calls 3977->3978 3979 40176a 3978->3979 3980 406187 2 API calls 3979->3980 3980->3979 4196 401d5d 4197 402d84 17 API calls 4196->4197 4198 401d6e SetWindowLongW 4197->4198 4199 402c2a 4198->4199 4200 4028de 4201 4028e6 4200->4201 4202 4028ea FindNextFileW 4201->4202 4204 4028fc 4201->4204 4203 402943 4202->4203 4202->4204 4206 406668 lstrcpynW 4203->4206 4206->4204 4207 406d5f 4213 406be3 4207->4213 4208 40754e 4209 406c64 GlobalFree 4210 406c6d GlobalAlloc 4209->4210 4210->4208 4210->4213 4211 406ce4 GlobalAlloc 4211->4208 4211->4213 4212 406cdb GlobalFree 4212->4211 4213->4208 4213->4209 4213->4210 4213->4211 4213->4212 4214 401563 4215 402ba4 4214->4215 4218 4065af wsprintfW 4215->4218 4217 402ba9 4218->4217 4219 401968 4220 402d84 17 API calls 4219->4220 4221 40196f 4220->4221 4222 402d84 17 API calls 4221->4222 4223 40197c 4222->4223 4224 402da6 17 API calls 4223->4224 4225 401993 lstrlenW 4224->4225 4227 4019a4 4225->4227 4226 4019e5 4227->4226 4231 406668 lstrcpynW 4227->4231 4229 4019d5 4229->4226 4230 4019da lstrlenW 4229->4230 4230->4226 4231->4229 4239 40166a 4240 402da6 17 API calls 4239->4240 4241 401670 4240->4241 4242 40699e 2 API calls 4241->4242 4243 401676 4242->4243 4244 402aeb 4245 402d84 17 API calls 4244->4245 4246 402af1 4245->4246 4247 4066a5 17 API calls 4246->4247 4248 40292e 4246->4248 4247->4248 4249 4026ec 4250 402d84 17 API calls 4249->4250 4251 4026fb 4250->4251 4252 402745 ReadFile 4251->4252 4253 4061db ReadFile 4251->4253 4255 402785 MultiByteToWideChar 4251->4255 4256 40283a 4251->4256 4258 4027ab SetFilePointer MultiByteToWideChar 4251->4258 4259 40284b 4251->4259 4261 402838 4251->4261 4262 406239 SetFilePointer 4251->4262 4252->4251 4252->4261 4253->4251 4255->4251 4271 4065af wsprintfW 4256->4271 4258->4251 4260 40286c SetFilePointer 4259->4260 4259->4261 4260->4261 4263 406255 4262->4263 4266 40626d 4262->4266 4264 4061db ReadFile 4263->4264 4265 406261 4264->4265 4265->4266 4267 406276 SetFilePointer 4265->4267 4268 40629e SetFilePointer 4265->4268 4266->4251 4267->4268 4269 406281 4267->4269 4268->4266 4270 40620a WriteFile 4269->4270 4270->4266 4271->4261 4272 404a6e 4273 404aa4 4272->4273 4274 404a7e 4272->4274 4276 40462b 8 API calls 4273->4276 4275 4045c4 18 API calls 4274->4275 4277 404a8b SetDlgItemTextW 4275->4277 4278 404ab0 4276->4278 4277->4273 3855 40176f 3856 402da6 17 API calls 3855->3856 3857 401776 3856->3857 3858 401796 3857->3858 3859 40179e 3857->3859 3894 406668 lstrcpynW 3858->3894 3895 406668 lstrcpynW 3859->3895 3862 40179c 3866 4068ef 5 API calls 3862->3866 3863 4017a9 3864 405f37 3 API calls 3863->3864 3865 4017af lstrcatW 3864->3865 3865->3862 3886 4017bb 3866->3886 3867 40699e 2 API calls 3867->3886 3868 406133 2 API calls 3868->3886 3870 4017cd CompareFileTime 3870->3886 3871 40188d 3873 4056ca 24 API calls 3871->3873 3872 401864 3874 4056ca 24 API calls 3872->3874 3882 401879 3872->3882 3875 401897 3873->3875 3874->3882 3876 403371 44 API calls 3875->3876 3877 4018aa 3876->3877 3878 4018be SetFileTime 3877->3878 3879 4018d0 CloseHandle 3877->3879 3878->3879 3881 4018e1 3879->3881 3879->3882 3880 4066a5 17 API calls 3880->3886 3884 4018e6 3881->3884 3885 4018f9 3881->3885 3883 406668 lstrcpynW 3883->3886 3887 4066a5 17 API calls 3884->3887 3888 4066a5 17 API calls 3885->3888 3886->3867 3886->3868 3886->3870 3886->3871 3886->3872 3886->3880 3886->3883 3889 405cc8 MessageBoxIndirectW 3886->3889 3893 406158 GetFileAttributesW CreateFileW 3886->3893 3890 4018ee lstrcatW 3887->3890 3891 401901 3888->3891 3889->3886 3890->3891 3892 405cc8 MessageBoxIndirectW 3891->3892 3892->3882 3893->3886 3894->3862 3895->3863 4279 401a72 4280 402d84 17 API calls 4279->4280 4281 401a7b 4280->4281 4282 402d84 17 API calls 4281->4282 4283 401a20 4282->4283 4284 401573 4285 401583 ShowWindow 4284->4285 4286 40158c 4284->4286 4285->4286 4287 402c2a 4286->4287 4288 40159a ShowWindow 4286->4288 4288->4287 4289 4023f4 4290 402da6 17 API calls 4289->4290 4291 402403 4290->4291 4292 402da6 17 API calls 4291->4292 4293 40240c 4292->4293 4294 402da6 17 API calls 4293->4294 4295 402416 GetPrivateProfileStringW 4294->4295 4296 4014f5 SetForegroundWindow 4297 402c2a 4296->4297 4298 401ff6 4299 402da6 17 API calls 4298->4299 4300 401ffd 4299->4300 4301 40699e 2 API calls 4300->4301 4302 402003 4301->4302 4304 402014 4302->4304 4305 4065af wsprintfW 4302->4305 4305->4304 4306 401b77 4307 402da6 17 API calls 4306->4307 4308 401b7e 4307->4308 4309 402d84 17 API calls 4308->4309 4310 401b87 wsprintfW 4309->4310 4311 402c2a 4310->4311 4312 4046fa lstrcpynW lstrlenW 4313 40167b 4314 402da6 17 API calls 4313->4314 4315 401682 4314->4315 4316 402da6 17 API calls 4315->4316 4317 40168b 4316->4317 4318 402da6 17 API calls 4317->4318 4319 401694 MoveFileW 4318->4319 4320 4016a0 4319->4320 4321 4016a7 4319->4321 4323 401423 24 API calls 4320->4323 4322 40699e 2 API calls 4321->4322 4325 4022f6 4321->4325 4324 4016b6 4322->4324 4323->4325 4324->4325 4326 406428 36 API calls 4324->4326 4326->4320 4334 4019ff 4335 402da6 17 API calls 4334->4335 4336 401a06 4335->4336 4337 402da6 17 API calls 4336->4337 4338 401a0f 4337->4338 4339 401a16 lstrcmpiW 4338->4339 4340 401a28 lstrcmpW 4338->4340 4341 401a1c 4339->4341 4340->4341 4342 4022ff 4343 402da6 17 API calls 4342->4343 4344 402305 4343->4344 4345 402da6 17 API calls 4344->4345 4346 40230e 4345->4346 4347 402da6 17 API calls 4346->4347 4348 402317 4347->4348 4349 40699e 2 API calls 4348->4349 4350 402320 4349->4350 4351 402331 lstrlenW lstrlenW 4350->4351 4352 402324 4350->4352 4354 4056ca 24 API calls 4351->4354 4353 4056ca 24 API calls 4352->4353 4356 40232c 4352->4356 4353->4356 4355 40236f SHFileOperationW 4354->4355 4355->4352 4355->4356 4357 401000 4358 401037 BeginPaint GetClientRect 4357->4358 4359 40100c DefWindowProcW 4357->4359 4361 4010f3 4358->4361 4362 401179 4359->4362 4363 401073 CreateBrushIndirect FillRect DeleteObject 4361->4363 4364 4010fc 4361->4364 4363->4361 4365 401102 CreateFontIndirectW 4364->4365 4366 401167 EndPaint 4364->4366 4365->4366 4367 401112 6 API calls 4365->4367 4366->4362 4367->4366 4368 401d81 4369 401d94 GetDlgItem 4368->4369 4370 401d87 4368->4370 4372 401d8e 4369->4372 4371 402d84 17 API calls 4370->4371 4371->4372 4373 401dd5 GetClientRect LoadImageW SendMessageW 4372->4373 4375 402da6 17 API calls 4372->4375 4376 401e33 4373->4376 4378 401e3f 4373->4378 4375->4373 4377 401e38 DeleteObject 4376->4377 4376->4378 4377->4378 4379 401503 4380 40150b 4379->4380 4382 40151e 4379->4382 4381 402d84 17 API calls 4380->4381 4381->4382 4383 404783 4384 40479b 4383->4384 4388 4048b5 4383->4388 4389 4045c4 18 API calls 4384->4389 4385 40491f 4386 4049e9 4385->4386 4387 404929 GetDlgItem 4385->4387 4394 40462b 8 API calls 4386->4394 4390 404943 4387->4390 4391 4049aa 4387->4391 4388->4385 4388->4386 4392 4048f0 GetDlgItem SendMessageW 4388->4392 4393 404802 4389->4393 4390->4391 4399 404969 SendMessageW LoadCursorW SetCursor 4390->4399 4391->4386 4395 4049bc 4391->4395 4416 4045e6 EnableWindow 4392->4416 4397 4045c4 18 API calls 4393->4397 4398 4049e4 4394->4398 4400 4049d2 4395->4400 4401 4049c2 SendMessageW 4395->4401 4403 40480f CheckDlgButton 4397->4403 4420 404a32 4399->4420 4400->4398 4406 4049d8 SendMessageW 4400->4406 4401->4400 4402 40491a 4417 404a0e 4402->4417 4414 4045e6 EnableWindow 4403->4414 4406->4398 4409 40482d GetDlgItem 4415 4045f9 SendMessageW 4409->4415 4411 404843 SendMessageW 4412 404860 GetSysColor 4411->4412 4413 404869 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 4411->4413 4412->4413 4413->4398 4414->4409 4415->4411 4416->4402 4418 404a21 SendMessageW 4417->4418 4419 404a1c 4417->4419 4418->4385 4419->4418 4423 405c8e ShellExecuteExW 4420->4423 4422 404998 LoadCursorW SetCursor 4422->4391 4423->4422 4424 402383 4425 40238a 4424->4425 4428 40239d 4424->4428 4426 4066a5 17 API calls 4425->4426 4427 402397 4426->4427 4429 405cc8 MessageBoxIndirectW 4427->4429 4429->4428 4430 402c05 SendMessageW 4431 402c2a 4430->4431 4432 402c1f InvalidateRect 4430->4432 4432->4431 3790 401389 3792 401390 3790->3792 3791 4013fe 3792->3791 3793 4013cb MulDiv SendMessageW 3792->3793 3793->3792 4433 405809 4434 4059b3 4433->4434 4435 40582a GetDlgItem GetDlgItem GetDlgItem 4433->4435 4437 4059e4 4434->4437 4438 4059bc GetDlgItem CreateThread CloseHandle 4434->4438 4478 4045f9 SendMessageW 4435->4478 4440 405a0f 4437->4440 4441 405a34 4437->4441 4442 4059fb ShowWindow ShowWindow 4437->4442 4438->4437 4439 40589a 4444 4058a1 GetClientRect GetSystemMetrics SendMessageW SendMessageW 4439->4444 4443 405a6f 4440->4443 4446 405a23 4440->4446 4447 405a49 ShowWindow 4440->4447 4448 40462b 8 API calls 4441->4448 4480 4045f9 SendMessageW 4442->4480 4443->4441 4453 405a7d SendMessageW 4443->4453 4451 4058f3 SendMessageW SendMessageW 4444->4451 4452 40590f 4444->4452 4454 40459d SendMessageW 4446->4454 4449 405a69 4447->4449 4450 405a5b 4447->4450 4459 405a42 4448->4459 4456 40459d SendMessageW 4449->4456 4455 4056ca 24 API calls 4450->4455 4451->4452 4457 405922 4452->4457 4458 405914 SendMessageW 4452->4458 4453->4459 4460 405a96 CreatePopupMenu 4453->4460 4454->4441 4455->4449 4456->4443 4462 4045c4 18 API calls 4457->4462 4458->4457 4461 4066a5 17 API calls 4460->4461 4463 405aa6 AppendMenuW 4461->4463 4464 405932 4462->4464 4465 405ac3 GetWindowRect 4463->4465 4466 405ad6 TrackPopupMenu 4463->4466 4467 40593b ShowWindow 4464->4467 4468 40596f GetDlgItem SendMessageW 4464->4468 4465->4466 4466->4459 4470 405af1 4466->4470 4471 405951 ShowWindow 4467->4471 4472 40595e 4467->4472 4468->4459 4469 405996 SendMessageW SendMessageW 4468->4469 4469->4459 4473 405b0d SendMessageW 4470->4473 4471->4472 4479 4045f9 SendMessageW 4472->4479 4473->4473 4474 405b2a OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 4473->4474 4476 405b4f SendMessageW 4474->4476 4476->4476 4477 405b78 GlobalUnlock SetClipboardData CloseClipboard 4476->4477 4477->4459 4478->4439 4479->4468 4480->4440 3794 40248a 3795 402da6 17 API calls 3794->3795 3796 40249c 3795->3796 3797 402da6 17 API calls 3796->3797 3798 4024a6 3797->3798 3811 402e36 3798->3811 3801 40292e 3802 4024de 3804 4024ea 3802->3804 3815 402d84 3802->3815 3803 402da6 17 API calls 3805 4024d4 lstrlenW 3803->3805 3807 402509 RegSetValueExW 3804->3807 3808 403371 44 API calls 3804->3808 3805->3802 3809 40251f RegCloseKey 3807->3809 3808->3807 3809->3801 3812 402e51 3811->3812 3818 406503 3812->3818 3816 4066a5 17 API calls 3815->3816 3817 402d99 3816->3817 3817->3804 3819 406512 3818->3819 3820 4024b6 3819->3820 3821 40651d RegCreateKeyExW 3819->3821 3820->3801 3820->3802 3820->3803 3821->3820 4481 404e0b 4482 404e37 4481->4482 4483 404e1b 4481->4483 4485 404e6a 4482->4485 4486 404e3d SHGetPathFromIDListW 4482->4486 4492 405cac GetDlgItemTextW 4483->4492 4487 404e54 SendMessageW 4486->4487 4488 404e4d 4486->4488 4487->4485 4490 40140b 2 API calls 4488->4490 4489 404e28 SendMessageW 4489->4482 4490->4487 4492->4489 4493 40290b 4494 402da6 17 API calls 4493->4494 4495 402912 FindFirstFileW 4494->4495 4496 40293a 4495->4496 4500 402925 4495->4500 4501 4065af wsprintfW 4496->4501 4498 402943 4502 406668 lstrcpynW 4498->4502 4501->4498 4502->4500 4503 40190c 4504 401943 4503->4504 4505 402da6 17 API calls 4504->4505 4506 401948 4505->4506 4507 405d74 67 API calls 4506->4507 4508 401951 4507->4508 4509 40190f 4510 402da6 17 API calls 4509->4510 4511 401916 4510->4511 4512 405cc8 MessageBoxIndirectW 4511->4512 4513 40191f 4512->4513 4514 401491 4515 4056ca 24 API calls 4514->4515 4516 401498 4515->4516 4517 402891 4518 402898 4517->4518 4519 402ba9 4517->4519 4520 402d84 17 API calls 4518->4520 4521 40289f 4520->4521 4522 4028ae SetFilePointer 4521->4522 4522->4519 4523 4028be 4522->4523 4525 4065af wsprintfW 4523->4525 4525->4519 4526 401f12 4527 402da6 17 API calls 4526->4527 4528 401f18 4527->4528 4529 402da6 17 API calls 4528->4529 4530 401f21 4529->4530 4531 402da6 17 API calls 4530->4531 4532 401f2a 4531->4532 4533 402da6 17 API calls 4532->4533 4534 401f33 4533->4534 4535 401423 24 API calls 4534->4535 4536 401f3a 4535->4536 4543 405c8e ShellExecuteExW 4536->4543 4538 401f82 4539 406ae0 5 API calls 4538->4539 4541 40292e 4538->4541 4540 401f9f CloseHandle 4539->4540 4540->4541 4543->4538 4544 402f93 4545 402fa5 SetTimer 4544->4545 4546 402fbe 4544->4546 4545->4546 4547 40300c 4546->4547 4548 403012 MulDiv 4546->4548 4549 402fcc wsprintfW SetWindowTextW SetDlgItemTextW 4548->4549 4549->4547 4565 401d17 4566 402d84 17 API calls 4565->4566 4567 401d1d IsWindow 4566->4567 4568 401a20 4567->4568 3952 401b9b 3953 401ba8 3952->3953 3954 401bec 3952->3954 3961 401bbf 3953->3961 3963 401c31 3953->3963 3955 401bf1 3954->3955 3956 401c16 GlobalAlloc 3954->3956 3960 40239d 3955->3960 3971 406668 lstrcpynW 3955->3971 3958 4066a5 17 API calls 3956->3958 3957 4066a5 17 API calls 3959 402397 3957->3959 3958->3963 3967 405cc8 MessageBoxIndirectW 3959->3967 3972 406668 lstrcpynW 3961->3972 3963->3957 3963->3960 3965 401c03 GlobalFree 3965->3960 3966 401bce 3973 406668 lstrcpynW 3966->3973 3967->3960 3969 401bdd 3974 406668 lstrcpynW 3969->3974 3971->3965 3972->3966 3973->3969 3974->3960 4569 40261c 4570 402da6 17 API calls 4569->4570 4571 402623 4570->4571 4574 406158 GetFileAttributesW CreateFileW 4571->4574 4573 40262f 4574->4573 3981 40259e 3982 402de6 17 API calls 3981->3982 3983 4025a8 3982->3983 3984 402d84 17 API calls 3983->3984 3985 4025b1 3984->3985 3986 40292e 3985->3986 3987 4025d9 RegEnumValueW 3985->3987 3988 4025cd RegEnumKeyW 3985->3988 3989 4025ee 3987->3989 3990 4025f5 RegCloseKey 3987->3990 3988->3990 3989->3990 3990->3986 4582 40149e 4583 4014ac PostQuitMessage 4582->4583 4584 40239d 4582->4584 4583->4584 4585 4015a3 4586 402da6 17 API calls 4585->4586 4587 4015aa SetFileAttributesW 4586->4587 4588 4015bc 4587->4588 3756 401fa4 3757 402da6 17 API calls 3756->3757 3758 401faa 3757->3758 3759 4056ca 24 API calls 3758->3759 3760 401fb4 3759->3760 3761 405c4b 2 API calls 3760->3761 3762 401fba 3761->3762 3763 401fdd CloseHandle 3762->3763 3767 40292e 3762->3767 3771 406ae0 WaitForSingleObject 3762->3771 3763->3767 3766 401fcf 3768 401fd4 3766->3768 3769 401fdf 3766->3769 3776 4065af wsprintfW 3768->3776 3769->3763 3772 406afa 3771->3772 3773 406b0c GetExitCodeProcess 3772->3773 3774 406a71 2 API calls 3772->3774 3773->3766 3775 406b01 WaitForSingleObject 3774->3775 3775->3772 3776->3763 3777 403c25 3778 403c40 3777->3778 3779 403c36 CloseHandle 3777->3779 3780 403c54 3778->3780 3781 403c4a CloseHandle 3778->3781 3779->3778 3786 403c82 3780->3786 3781->3780 3784 405d74 67 API calls 3785 403c65 3784->3785 3787 403c90 3786->3787 3788 403c59 3787->3788 3789 403c95 FreeLibrary GlobalFree 3787->3789 3788->3784 3789->3788 3789->3789 3822 40252a 3833 402de6 3822->3833 3825 402da6 17 API calls 3826 40253d 3825->3826 3827 402548 RegQueryValueExW 3826->3827 3831 40292e 3826->3831 3828 40256e RegCloseKey 3827->3828 3829 402568 3827->3829 3828->3831 3829->3828 3838 4065af wsprintfW 3829->3838 3834 402da6 17 API calls 3833->3834 3835 402dfd 3834->3835 3836 4064d5 RegOpenKeyExW 3835->3836 3837 402534 3836->3837 3837->3825 3838->3828 3839 4021aa 3840 402da6 17 API calls 3839->3840 3841 4021b1 3840->3841 3842 402da6 17 API calls 3841->3842 3843 4021bb 3842->3843 3844 402da6 17 API calls 3843->3844 3845 4021c5 3844->3845 3846 402da6 17 API calls 3845->3846 3847 4021cf 3846->3847 3848 402da6 17 API calls 3847->3848 3849 4021d9 3848->3849 3850 402218 CoCreateInstance 3849->3850 3851 402da6 17 API calls 3849->3851 3854 402237 3850->3854 3851->3850 3852 401423 24 API calls 3853 4022f6 3852->3853 3854->3852 3854->3853 4589 40202a 4590 402da6 17 API calls 4589->4590 4591 402031 4590->4591 4592 406a35 5 API calls 4591->4592 4593 402040 4592->4593 4594 4020cc 4593->4594 4595 40205c GlobalAlloc 4593->4595 4595->4594 4596 402070 4595->4596 4597 406a35 5 API calls 4596->4597 4598 402077 4597->4598 4599 406a35 5 API calls 4598->4599 4600 402081 4599->4600 4600->4594 4604 4065af wsprintfW 4600->4604 4602 4020ba 4605 4065af wsprintfW 4602->4605 4604->4602 4605->4594 4613 401a30 4614 402da6 17 API calls 4613->4614 4615 401a39 ExpandEnvironmentStringsW 4614->4615 4616 401a60 4615->4616 4617 401a4d 4615->4617 4617->4616 4618 401a52 lstrcmpW 4617->4618 4618->4616 4619 405031 GetDlgItem GetDlgItem 4620 405083 7 API calls 4619->4620 4621 4052a8 4619->4621 4622 40512a DeleteObject 4620->4622 4623 40511d SendMessageW 4620->4623 4626 40538a 4621->4626 4653 405317 4621->4653 4673 404f7f SendMessageW 4621->4673 4624 405133 4622->4624 4623->4622 4625 40516a 4624->4625 4629 4066a5 17 API calls 4624->4629 4627 4045c4 18 API calls 4625->4627 4628 405436 4626->4628 4632 40529b 4626->4632 4638 4053e3 SendMessageW 4626->4638 4631 40517e 4627->4631 4633 405440 SendMessageW 4628->4633 4634 405448 4628->4634 4630 40514c SendMessageW SendMessageW 4629->4630 4630->4624 4637 4045c4 18 API calls 4631->4637 4635 40462b 8 API calls 4632->4635 4633->4634 4641 405461 4634->4641 4642 40545a ImageList_Destroy 4634->4642 4649 405471 4634->4649 4640 405637 4635->4640 4654 40518f 4637->4654 4638->4632 4644 4053f8 SendMessageW 4638->4644 4639 40537c SendMessageW 4639->4626 4645 40546a GlobalFree 4641->4645 4641->4649 4642->4641 4643 4055eb 4643->4632 4650 4055fd ShowWindow GetDlgItem ShowWindow 4643->4650 4647 40540b 4644->4647 4645->4649 4646 40526a GetWindowLongW SetWindowLongW 4648 405283 4646->4648 4658 40541c SendMessageW 4647->4658 4651 4052a0 4648->4651 4652 405288 ShowWindow 4648->4652 4649->4643 4666 4054ac 4649->4666 4678 404fff 4649->4678 4650->4632 4672 4045f9 SendMessageW 4651->4672 4671 4045f9 SendMessageW 4652->4671 4653->4626 4653->4639 4654->4646 4657 4051e2 SendMessageW 4654->4657 4659 405265 4654->4659 4660 405220 SendMessageW 4654->4660 4661 405234 SendMessageW 4654->4661 4657->4654 4658->4628 4659->4646 4659->4648 4660->4654 4661->4654 4663 4055b6 4664 4055c1 InvalidateRect 4663->4664 4667 4055cd 4663->4667 4664->4667 4665 4054da SendMessageW 4669 4054f0 4665->4669 4666->4665 4666->4669 4667->4643 4687 404f3a 4667->4687 4668 405564 SendMessageW SendMessageW 4668->4669 4669->4663 4669->4668 4671->4632 4672->4621 4674 404fa2 GetMessagePos ScreenToClient SendMessageW 4673->4674 4675 404fde SendMessageW 4673->4675 4676 404fd6 4674->4676 4677 404fdb 4674->4677 4675->4676 4676->4653 4677->4675 4690 406668 lstrcpynW 4678->4690 4680 405012 4691 4065af wsprintfW 4680->4691 4682 40501c 4683 40140b 2 API calls 4682->4683 4684 405025 4683->4684 4692 406668 lstrcpynW 4684->4692 4686 40502c 4686->4666 4693 404e71 4687->4693 4689 404f4f 4689->4643 4690->4680 4691->4682 4692->4686 4694 404e8a 4693->4694 4695 4066a5 17 API calls 4694->4695 4696 404eee 4695->4696 4697 4066a5 17 API calls 4696->4697 4698 404ef9 4697->4698 4699 4066a5 17 API calls 4698->4699 4700 404f0f lstrlenW wsprintfW SetDlgItemTextW 4699->4700 4700->4689 4706 4023b2 4707 4023ba 4706->4707 4710 4023c0 4706->4710 4708 402da6 17 API calls 4707->4708 4708->4710 4709 4023ce 4712 4023dc 4709->4712 4713 402da6 17 API calls 4709->4713 4710->4709 4711 402da6 17 API calls 4710->4711 4711->4709 4714 402da6 17 API calls 4712->4714 4713->4712 4715 4023e5 WritePrivateProfileStringW 4714->4715 4716 404734 lstrlenW 4717 404753 4716->4717 4718 404755 WideCharToMultiByte 4716->4718 4717->4718 4719 402434 4720 402467 4719->4720 4721 40243c 4719->4721 4723 402da6 17 API calls 4720->4723 4722 402de6 17 API calls 4721->4722 4724 402443 4722->4724 4725 40246e 4723->4725 4727 402da6 17 API calls 4724->4727 4729 40247b 4724->4729 4730 402e64 4725->4730 4728 402454 RegDeleteValueW RegCloseKey 4727->4728 4728->4729 4731 402e78 4730->4731 4733 402e71 4730->4733 4731->4733 4734 402ea9 4731->4734 4733->4729 4735 4064d5 RegOpenKeyExW 4734->4735 4736 402ed7 4735->4736 4737 402ee7 RegEnumValueW 4736->4737 4744 402f81 4736->4744 4746 402f0a 4736->4746 4738 402f71 RegCloseKey 4737->4738 4737->4746 4738->4744 4739 402f46 RegEnumKeyW 4740 402f4f RegCloseKey 4739->4740 4739->4746 4741 406a35 5 API calls 4740->4741 4742 402f5f 4741->4742 4742->4744 4745 402f63 RegDeleteKeyW 4742->4745 4743 402ea9 6 API calls 4743->4746 4744->4733 4745->4744 4746->4738 4746->4739 4746->4740 4746->4743 4747 401735 4748 402da6 17 API calls 4747->4748 4749 40173c SearchPathW 4748->4749 4750 401757 4749->4750 4751 404ab5 4752 404ae1 4751->4752 4753 404af2 4751->4753 4812 405cac GetDlgItemTextW 4752->4812 4755 404afe GetDlgItem 4753->4755 4760 404b5d 4753->4760 4758 404b12 4755->4758 4756 404c41 4761 404df0 4756->4761 4814 405cac GetDlgItemTextW 4756->4814 4757 404aec 4759 4068ef 5 API calls 4757->4759 4763 404b26 SetWindowTextW 4758->4763 4764 405fe2 4 API calls 4758->4764 4759->4753 4760->4756 4760->4761 4765 4066a5 17 API calls 4760->4765 4768 40462b 8 API calls 4761->4768 4767 4045c4 18 API calls 4763->4767 4769 404b1c 4764->4769 4770 404bd1 SHBrowseForFolderW 4765->4770 4766 404c71 4771 40603f 18 API calls 4766->4771 4772 404b42 4767->4772 4773 404e04 4768->4773 4769->4763 4777 405f37 3 API calls 4769->4777 4770->4756 4774 404be9 CoTaskMemFree 4770->4774 4775 404c77 4771->4775 4776 4045c4 18 API calls 4772->4776 4778 405f37 3 API calls 4774->4778 4815 406668 lstrcpynW 4775->4815 4779 404b50 4776->4779 4777->4763 4780 404bf6 4778->4780 4813 4045f9 SendMessageW 4779->4813 4783 404c2d SetDlgItemTextW 4780->4783 4788 4066a5 17 API calls 4780->4788 4783->4756 4784 404b56 4786 406a35 5 API calls 4784->4786 4785 404c8e 4787 406a35 5 API calls 4785->4787 4786->4760 4794 404c95 4787->4794 4789 404c15 lstrcmpiW 4788->4789 4789->4783 4792 404c26 lstrcatW 4789->4792 4790 404cd6 4816 406668 lstrcpynW 4790->4816 4792->4783 4793 404cdd 4795 405fe2 4 API calls 4793->4795 4794->4790 4798 405f83 2 API calls 4794->4798 4800 404d2e 4794->4800 4796 404ce3 GetDiskFreeSpaceW 4795->4796 4799 404d07 MulDiv 4796->4799 4796->4800 4798->4794 4799->4800 4802 404f3a 20 API calls 4800->4802 4810 404d9f 4800->4810 4801 404dc2 4817 4045e6 EnableWindow 4801->4817 4804 404d8c 4802->4804 4803 40140b 2 API calls 4803->4801 4806 404da1 SetDlgItemTextW 4804->4806 4807 404d91 4804->4807 4806->4810 4808 404e71 20 API calls 4807->4808 4808->4810 4809 404dde 4809->4761 4811 404a0e SendMessageW 4809->4811 4810->4801 4810->4803 4811->4761 4812->4757 4813->4784 4814->4766 4815->4785 4816->4793 4817->4809 4818 401d38 4819 402d84 17 API calls 4818->4819 4820 401d3f 4819->4820 4821 402d84 17 API calls 4820->4821 4822 401d4b GetDlgItem 4821->4822 4823 402638 4822->4823 4824 4014b8 4825 4014be 4824->4825 4826 401389 2 API calls 4825->4826 4827 4014c6 4826->4827 4828 40563e 4829 405662 4828->4829 4830 40564e 4828->4830 4833 40566a IsWindowVisible 4829->4833 4839 405681 4829->4839 4831 405654 4830->4831 4832 4056ab 4830->4832 4835 404610 SendMessageW 4831->4835 4834 4056b0 CallWindowProcW 4832->4834 4833->4832 4836 405677 4833->4836 4837 40565e 4834->4837 4835->4837 4838 404f7f 5 API calls 4836->4838 4838->4839 4839->4834 4840 404fff 4 API calls 4839->4840 4840->4832 4841 40263e 4842 402652 4841->4842 4843 40266d 4841->4843 4844 402d84 17 API calls 4842->4844 4845 402672 4843->4845 4846 40269d 4843->4846 4855 402659 4844->4855 4848 402da6 17 API calls 4845->4848 4847 402da6 17 API calls 4846->4847 4850 4026a4 lstrlenW 4847->4850 4849 402679 4848->4849 4858 40668a WideCharToMultiByte 4849->4858 4850->4855 4852 40268d lstrlenA 4852->4855 4853 4026e7 4854 4026d1 4854->4853 4856 40620a WriteFile 4854->4856 4855->4853 4855->4854 4857 406239 5 API calls 4855->4857 4856->4853 4857->4854 4858->4852

                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                          Function 00403640 Relevance: 93.2, APIs: 34, Strings: 19, Instructions: 450stringfilecomCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 0 403640-403690 SetErrorMode GetVersionExW 1 403692-4036c6 GetVersionExW 0->1 2 4036ca-4036d1 0->2 1->2 3 4036d3 2->3 4 4036db-40371b 2->4 3->4 5 40371d-403725 call 406a35 4->5 6 40372e 4->6 5->6 11 403727 5->11 8 403733-403747 call 4069c5 lstrlenA 6->8 13 403749-403765 call 406a35 * 3 8->13 11->6 20 403776-4037d8 #17 OleInitialize SHGetFileInfoW call 406668 GetCommandLineW call 406668 13->20 21 403767-40376d 13->21 28 4037e1-4037f4 call 405f64 CharNextW 20->28 29 4037da-4037dc 20->29 21->20 25 40376f 21->25 25->20 32 4038eb-4038f1 28->32 29->28 33 4038f7 32->33 34 4037f9-4037ff 32->34 37 40390b-403925 GetTempPathW call 40360f 33->37 35 403801-403806 34->35 36 403808-40380e 34->36 35->35 35->36 38 403810-403814 36->38 39 403815-403819 36->39 47 403927-403945 GetWindowsDirectoryW lstrcatW call 40360f 37->47 48 40397d-403995 DeleteFileW call 4030d0 37->48 38->39 41 4038d9-4038e7 call 405f64 39->41 42 40381f-403825 39->42 41->32 58 4038e9-4038ea 41->58 45 403827-40382e 42->45 46 40383f-403878 42->46 51 403830-403833 45->51 52 403835 45->52 53 403894-4038ce 46->53 54 40387a-40387f 46->54 47->48 62 403947-403977 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 40360f 47->62 64 40399b-4039a1 48->64 65 403b6c-403b7a ExitProcess CoUninitialize 48->65 51->46 51->52 52->46 56 4038d0-4038d4 53->56 57 4038d6-4038d8 53->57 54->53 60 403881-403889 54->60 56->57 63 4038f9-403906 call 406668 56->63 57->41 58->32 66 403890 60->66 67 40388b-40388e 60->67 62->48 62->65 63->37 69 4039a7-4039ba call 405f64 64->69 70 403a48-403a4f call 403d17 64->70 72 403b91-403b97 65->72 73 403b7c-403b8b call 405cc8 ExitProcess 65->73 66->53 67->53 67->66 88 403a0c-403a19 69->88 89 4039bc-4039f1 69->89 83 403a54-403a57 70->83 74 403b99-403bae GetCurrentProcess OpenProcessToken 72->74 75 403c0f-403c17 72->75 80 403bb0-403bd9 LookupPrivilegeValueW AdjustTokenPrivileges 74->80 81 403bdf-403bed call 406a35 74->81 84 403c19 75->84 85 403c1c-403c1f ExitProcess 75->85 80->81 95 403bfb-403c06 ExitWindowsEx 81->95 96 403bef-403bf9 81->96 83->65 84->85 90 403a1b-403a29 call 40603f 88->90 91 403a5c-403a70 call 405c33 lstrcatW 88->91 93 4039f3-4039f7 89->93 90->65 104 403a2f-403a45 call 406668 * 2 90->104 107 403a72-403a78 lstrcatW 91->107 108 403a7d-403a97 lstrcatW lstrcmpiW 91->108 98 403a00-403a08 93->98 99 4039f9-4039fe 93->99 95->75 101 403c08-403c0a call 40140b 95->101 96->95 96->101 98->93 103 403a0a 98->103 99->98 99->103 101->75 103->88 104->70 107->108 109 403b6a 108->109 110 403a9d-403aa0 108->110 109->65 112 403aa2-403aa7 call 405b99 110->112 113 403aa9 call 405c16 110->113 119 403aae-403abe SetCurrentDirectoryW 112->119 113->119 121 403ac0-403ac6 call 406668 119->121 122 403acb-403af7 call 406668 119->122 121->122 126 403afc-403b17 call 4066a5 DeleteFileW 122->126 129 403b57-403b61 126->129 130 403b19-403b29 CopyFileW 126->130 129->126 132 403b63-403b65 call 406428 129->132 130->129 131 403b2b-403b4b call 406428 call 4066a5 call 405c4b 130->131 131->129 140 403b4d-403b54 CloseHandle 131->140 132->109 140->129
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00008001), ref: 00403663
                                                                                                                                                                                                                          • GetVersionExW.KERNEL32(?), ref: 0040368C
                                                                                                                                                                                                                          • GetVersionExW.KERNEL32(0000011C), ref: 004036A3
                                                                                                                                                                                                                          • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040373A
                                                                                                                                                                                                                          • #17.COMCTL32(00000007,00000009,0000000B), ref: 00403776
                                                                                                                                                                                                                          • OleInitialize.OLE32(00000000), ref: 0040377D
                                                                                                                                                                                                                          • SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 0040379B
                                                                                                                                                                                                                          • GetCommandLineW.KERNEL32(00429260,NSIS Error), ref: 004037B0
                                                                                                                                                                                                                          • CharNextW.USER32(00000000,"C:\Users\user\AppData\Local\Temp\nsb5A9.tmp" /internal 1730911513052455 /force,00000020,"C:\Users\user\AppData\Local\Temp\nsb5A9.tmp" /internal 1730911513052455 /force,00000000), ref: 004037E9
                                                                                                                                                                                                                          • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 0040391C
                                                                                                                                                                                                                          • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040392D
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403939
                                                                                                                                                                                                                          • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040394D
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403955
                                                                                                                                                                                                                          • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403966
                                                                                                                                                                                                                          • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040396E
                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(1033), ref: 00403982
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsb5A9.tmp" /internal 1730911513052455 /force,00000000,?), ref: 00403A69
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsb5A9.tmp" /internal 1730911513052455 /force,00000000,?), ref: 00403A78
                                                                                                                                                                                                                            • Part of subcall function 00405C16: CreateDirectoryW.KERNEL32(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsb5A9.tmp" /internal 1730911513052455 /force,00000000,?), ref: 00403A83
                                                                                                                                                                                                                          • lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsb5A9.tmp" /internal 1730911513052455 /force,00000000,?), ref: 00403A8F
                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AAF
                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(00420F08,00420F08,?,5957453,?), ref: 00403B0E
                                                                                                                                                                                                                          • CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsb5A9.tmp,00420F08,00000001), ref: 00403B21
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000), ref: 00403B4E
                                                                                                                                                                                                                          • ExitProcess.KERNEL32(?), ref: 00403B6C
                                                                                                                                                                                                                          • CoUninitialize.COMBASE(?), ref: 00403B71
                                                                                                                                                                                                                          • ExitProcess.KERNEL32 ref: 00403B8B
                                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403B9F
                                                                                                                                                                                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 00403BA6
                                                                                                                                                                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403BBA
                                                                                                                                                                                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403BD9
                                                                                                                                                                                                                          • ExitWindowsEx.USER32(00000002,80040002), ref: 00403BFE
                                                                                                                                                                                                                          • ExitProcess.KERNEL32 ref: 00403C1F
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
                                                                                                                                                                                                                          • String ID: "C:\Users\user\AppData\Local\Temp\nsb5A9.tmp" /internal 1730911513052455 /force$.tmp$1033$5957453$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsb5A9.tmp$C:\Users\user\PCAppStore$C:\Users\user\PCAppStore$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                                                                          • API String ID: 2292928366-3235259693
                                                                                                                                                                                                                          • Opcode ID: 54eba713b65b488fe05b557adb658f0301d1077f312d6d7219dab3d109336353
                                                                                                                                                                                                                          • Instruction ID: d56582c8b11bee4b9d4e83ad1f604629a9588d533935b381636b20c84fba3529
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 54eba713b65b488fe05b557adb658f0301d1077f312d6d7219dab3d109336353
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4E1F471A00214AADB20AFB58D45A6E3EB8EB05709F50847FF945B32D1DB7C8A41CB6D
                                                                                                                                                                                                                          Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148filestringCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 346 405d74-405d9a call 40603f 349 405db3-405dba 346->349 350 405d9c-405dae DeleteFileW 346->350 352 405dbc-405dbe 349->352 353 405dcd-405ddd call 406668 349->353 351 405f30-405f34 350->351 354 405dc4-405dc7 352->354 355 405ede-405ee3 352->355 361 405dec-405ded call 405f83 353->361 362 405ddf-405dea lstrcatW 353->362 354->353 354->355 355->351 357 405ee5-405ee8 355->357 359 405ef2-405efa call 40699e 357->359 360 405eea-405ef0 357->360 359->351 370 405efc-405f10 call 405f37 call 405d2c 359->370 360->351 365 405df2-405df6 361->365 362->365 366 405e02-405e08 lstrcatW 365->366 367 405df8-405e00 365->367 369 405e0d-405e29 lstrlenW FindFirstFileW 366->369 367->366 367->369 371 405ed3-405ed7 369->371 372 405e2f-405e37 369->372 386 405f12-405f15 370->386 387 405f28-405f2b call 4056ca 370->387 371->355 377 405ed9 371->377 374 405e57-405e6b call 406668 372->374 375 405e39-405e41 372->375 388 405e82-405e8d call 405d2c 374->388 389 405e6d-405e75 374->389 378 405e43-405e4b 375->378 379 405eb6-405ec6 FindNextFileW 375->379 377->355 378->374 382 405e4d-405e55 378->382 379->372 385 405ecc-405ecd FindClose 379->385 382->374 382->379 385->371 386->360 392 405f17-405f26 call 4056ca call 406428 386->392 387->351 397 405eae-405eb1 call 4056ca 388->397 398 405e8f-405e92 388->398 389->379 393 405e77-405e80 call 405d74 389->393 392->351 393->379 397->379 401 405e94-405ea4 call 4056ca call 406428 398->401 402 405ea6-405eac 398->402 401->379 402->379
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,?,74DF3420,74DF2EE0,00000000), ref: 00405D9D
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nse5976.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nse5976.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405DE5
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nse5976.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405E08
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nse5976.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405E0E
                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nse5976.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nse5976.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405E1E
                                                                                                                                                                                                                          • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EBE
                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00405ECD
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                                          • String ID: .$.$C:\Users\user\AppData\Local\Temp\nse5976.tmp\*.*$\*.*
                                                                                                                                                                                                                          • API String ID: 2035342205-2209392313
                                                                                                                                                                                                                          • Opcode ID: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
                                                                                                                                                                                                                          • Instruction ID: 3801e3340fbbb9c460ab277ab089a7ece50ce31247a5b640c745bca9484d7288
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 46410330800A15AADB21AB61CC49BBF7678EF41715F50413FF881711D1DB7C4A82CEAE
                                                                                                                                                                                                                          Function 00406D5F Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 566 406d5f-406d64 567 406dd5-406df3 566->567 568 406d66-406d95 566->568 569 4073cb-4073e0 567->569 570 406d97-406d9a 568->570 571 406d9c-406da0 568->571 572 4073e2-4073f8 569->572 573 4073fa-407410 569->573 574 406dac-406daf 570->574 575 406da2-406da6 571->575 576 406da8 571->576 577 407413-40741a 572->577 573->577 578 406db1-406dba 574->578 579 406dcd-406dd0 574->579 575->574 576->574 583 407441-40744d 577->583 584 40741c-407420 577->584 580 406dbc 578->580 581 406dbf-406dcb 578->581 582 406fa2-406fc0 579->582 580->581 585 406e35-406e63 581->585 589 406fc2-406fd6 582->589 590 406fd8-406fea 582->590 592 406be3-406bec 583->592 586 407426-40743e 584->586 587 4075cf-4075d9 584->587 593 406e65-406e7d 585->593 594 406e7f-406e99 585->594 586->583 591 4075e5-4075f8 587->591 595 406fed-406ff7 589->595 590->595 599 4075fd-407601 591->599 596 406bf2 592->596 597 4075fa 592->597 598 406e9c-406ea6 593->598 594->598 600 406ff9 595->600 601 406f9a-406fa0 595->601 603 406bf9-406bfd 596->603 604 406d39-406d5a 596->604 605 406c9e-406ca2 596->605 606 406d0e-406d12 596->606 597->599 608 406eac 598->608 609 406e1d-406e23 598->609 617 407581-40758b 600->617 618 406f7f-406f97 600->618 601->582 607 406f3e-406f48 601->607 603->591 610 406c03-406c10 603->610 604->569 619 406ca8-406cc1 605->619 620 40754e-407558 605->620 611 406d18-406d2c 606->611 612 40755d-407567 606->612 613 40758d-407597 607->613 614 406f4e-407117 607->614 625 406e02-406e1a 608->625 626 407569-407573 608->626 615 406ed6-406edc 609->615 616 406e29-406e2f 609->616 610->597 624 406c16-406c5c 610->624 627 406d2f-406d37 611->627 612->591 613->591 614->592 622 406f3a 615->622 623 406ede-406efc 615->623 616->585 616->622 617->591 618->601 629 406cc4-406cc8 619->629 620->591 622->607 630 406f14-406f26 623->630 631 406efe-406f12 623->631 632 406c84-406c86 624->632 633 406c5e-406c62 624->633 625->609 626->591 627->604 627->606 629->605 634 406cca-406cd0 629->634 637 406f29-406f33 630->637 631->637 640 406c94-406c9c 632->640 641 406c88-406c92 632->641 638 406c64-406c67 GlobalFree 633->638 639 406c6d-406c7b GlobalAlloc 633->639 635 406cd2-406cd9 634->635 636 406cfa-406d0c 634->636 642 406ce4-406cf4 GlobalAlloc 635->642 643 406cdb-406cde GlobalFree 635->643 636->627 637->615 644 406f35 637->644 638->639 639->597 645 406c81 639->645 640->629 641->640 641->641 642->597 642->636 643->642 647 407575-40757f 644->647 648 406ebb-406ed3 644->648 645->632 647->591 648->615
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
                                                                                                                                                                                                                          • Instruction ID: 02c1e40b0c9780dd067322b7733c474732bd0f187a49f53fd7fd3c108ee94619
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7CF15570D04229CBDF28CFA8C8946ADBBB0FF44305F24816ED456BB281D7386A86DF45
                                                                                                                                                                                                                          Function 0040699E Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(74DF3420,00426798,00425F50,00406088,00425F50,00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0), ref: 004069A9
                                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 004069B5
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2295610775-0
                                                                                                                                                                                                                          • Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
                                                                                                                                                                                                                          • Instruction ID: 0ca7534fdffec89160a31ceabb6ef5ff718bfc83d1618d69d17f9e635378cbc3
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5ED012B15192205FC34057387E0C84B7A989F563317268A36B4AAF11E0CB348C3297AC
                                                                                                                                                                                                                          Function 00403D17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 141 403d17-403d2f call 406a35 144 403d31-403d41 call 4065af 141->144 145 403d43-403d7a call 406536 141->145 154 403d9d-403dc6 call 403fed call 40603f 144->154 150 403d92-403d98 lstrcatW 145->150 151 403d7c-403d8d call 406536 145->151 150->154 151->150 159 403e58-403e60 call 40603f 154->159 160 403dcc-403dd1 154->160 166 403e62-403e69 call 4066a5 159->166 167 403e6e-403e93 LoadImageW 159->167 160->159 162 403dd7-403dff call 406536 160->162 162->159 168 403e01-403e05 162->168 166->167 170 403f14-403f1c call 40140b 167->170 171 403e95-403ec5 RegisterClassW 167->171 172 403e17-403e23 lstrlenW 168->172 173 403e07-403e14 call 405f64 168->173 184 403f26-403f31 call 403fed 170->184 185 403f1e-403f21 170->185 174 403fe3 171->174 175 403ecb-403f0f SystemParametersInfoW CreateWindowExW 171->175 179 403e25-403e33 lstrcmpiW 172->179 180 403e4b-403e53 call 405f37 call 406668 172->180 173->172 178 403fe5-403fec 174->178 175->170 179->180 183 403e35-403e3f GetFileAttributesW 179->183 180->159 187 403e41-403e43 183->187 188 403e45-403e46 call 405f83 183->188 194 403f37-403f51 ShowWindow call 4069c5 184->194 195 403fba-403fc2 call 40579d 184->195 185->178 187->180 187->188 188->180 200 403f53-403f58 call 4069c5 194->200 201 403f5d-403f6f GetClassInfoW 194->201 202 403fc4-403fca 195->202 203 403fdc-403fde call 40140b 195->203 200->201 206 403f71-403f81 GetClassInfoW RegisterClassW 201->206 207 403f87-403fb8 DialogBoxParamW call 40140b call 403c67 201->207 202->185 208 403fd0-403fd7 call 40140b 202->208 203->174 206->207 207->178 208->185
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00406A35: GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
                                                                                                                                                                                                                            • Part of subcall function 00406A35: GetProcAddress.KERNEL32(00000000,?), ref: 00406A62
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403D98
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(get,?,?,?,get,00000000,C:\Users\user\PCAppStore,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,74DF3420), ref: 00403E18
                                                                                                                                                                                                                          • lstrcmpiW.KERNEL32(?,.exe,get,?,?,?,get,00000000,C:\Users\user\PCAppStore,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403E2B
                                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(get,?,00000000,?), ref: 00403E36
                                                                                                                                                                                                                          • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\PCAppStore), ref: 00403E7F
                                                                                                                                                                                                                            • Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC
                                                                                                                                                                                                                          • RegisterClassW.USER32(00429200), ref: 00403EBC
                                                                                                                                                                                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403ED4
                                                                                                                                                                                                                          • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403F09
                                                                                                                                                                                                                          • ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403F3F
                                                                                                                                                                                                                          • GetClassInfoW.USER32(00000000,RichEdit20W,00429200), ref: 00403F6B
                                                                                                                                                                                                                          • GetClassInfoW.USER32(00000000,RichEdit,00429200), ref: 00403F78
                                                                                                                                                                                                                          • RegisterClassW.USER32(00429200), ref: 00403F81
                                                                                                                                                                                                                          • DialogBoxParamW.USER32(?,00000000,004040C5,00000000), ref: 00403FA0
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                          • String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\PCAppStore$Control Panel\Desktop\ResourceLocale$H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb$get
                                                                                                                                                                                                                          • API String ID: 1975747703-284748347
                                                                                                                                                                                                                          • Opcode ID: 78a63079156de9a95659751e2075cee6996798d0e51b0c114acce594fd97feca
                                                                                                                                                                                                                          • Instruction ID: e235badc60aeba35c86cf297cd954ec43a22164425911800af60bc979c7621a1
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 78a63079156de9a95659751e2075cee6996798d0e51b0c114acce594fd97feca
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E661D570640201BAD730AF66AD45E2B3A7CEB84B49F40457FF945B22E1DB3D5911CA3D
                                                                                                                                                                                                                          Function 004030D0 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204memoryCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 215 4030d0-40311e GetTickCount GetModuleFileNameW call 406158 218 403120-403125 215->218 219 40312a-403158 call 406668 call 405f83 call 406668 GetFileSize 215->219 220 40336a-40336e 218->220 227 403243-403251 call 40302e 219->227 228 40315e 219->228 234 403322-403327 227->234 235 403257-40325a 227->235 230 403163-40317a 228->230 232 40317c 230->232 233 40317e-403187 call 4035e2 230->233 232->233 241 40318d-403194 233->241 242 4032de-4032e6 call 40302e 233->242 234->220 237 403286-4032d2 GlobalAlloc call 406b90 call 406187 CreateFileW 235->237 238 40325c-403274 call 4035f8 call 4035e2 235->238 266 4032d4-4032d9 237->266 267 4032e8-403318 call 4035f8 call 403371 237->267 238->234 261 40327a-403280 238->261 246 403210-403214 241->246 247 403196-4031aa call 406113 241->247 242->234 251 403216-40321d call 40302e 246->251 252 40321e-403224 246->252 247->252 264 4031ac-4031b3 247->264 251->252 257 403233-40323b 252->257 258 403226-403230 call 406b22 252->258 257->230 265 403241 257->265 258->257 261->234 261->237 264->252 270 4031b5-4031bc 264->270 265->227 266->220 276 40331d-403320 267->276 270->252 272 4031be-4031c5 270->272 272->252 273 4031c7-4031ce 272->273 273->252 275 4031d0-4031f0 273->275 275->234 277 4031f6-4031fa 275->277 276->234 278 403329-40333a 276->278 279 403202-40320a 277->279 280 4031fc-403200 277->280 281 403342-403347 278->281 282 40333c 278->282 279->252 283 40320c-40320e 279->283 280->265 280->279 284 403348-40334e 281->284 282->281 283->252 284->284 285 403350-403368 call 406113 284->285 285->220
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetTickCount.KERNEL32 ref: 004030E4
                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\nsb5A9.tmp,00000400), ref: 00403100
                                                                                                                                                                                                                            • Part of subcall function 00406158: GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nsb5A9.tmp,80000000,00000003), ref: 0040615C
                                                                                                                                                                                                                            • Part of subcall function 00406158: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E
                                                                                                                                                                                                                          • GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nsb5A9.tmp,C:\Users\user\AppData\Local\Temp\nsb5A9.tmp,80000000,00000003), ref: 00403149
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,?), ref: 0040328B
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsb5A9.tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                                                                                                                                          • API String ID: 2803837635-2423324494
                                                                                                                                                                                                                          • Opcode ID: dff409350d06ce17b221650d583fb97333c6afb1e6ebf9b4c6eec62bfd946937
                                                                                                                                                                                                                          • Instruction ID: 6a7077609e6cbe8902eef3654a796be60faa9129f620d49927b75729aeb44cd1
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dff409350d06ce17b221650d583fb97333c6afb1e6ebf9b4c6eec62bfd946937
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 74710271A40204ABDB20DFB5DD85B9E3AACAB04315F21457FF901B72D2CB789E418B6D
                                                                                                                                                                                                                          Function 004066A5 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 196stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 288 4066a5-4066b0 289 4066b2-4066c1 288->289 290 4066c3-4066d9 288->290 289->290 291 4066f1-4066fa 290->291 292 4066db-4066e8 290->292 294 406700 291->294 295 4068d5-4068e0 291->295 292->291 293 4066ea-4066ed 292->293 293->291 296 406705-406712 294->296 297 4068e2-4068e6 call 406668 295->297 298 4068eb-4068ec 295->298 296->295 299 406718-406721 296->299 297->298 301 4068b3 299->301 302 406727-406764 299->302 303 4068c1-4068c4 301->303 304 4068b5-4068bf 301->304 305 406857-40685c 302->305 306 40676a-406771 302->306 307 4068c6-4068cf 303->307 304->307 308 40685e-406864 305->308 309 40688f-406894 305->309 310 406773-406775 306->310 311 406776-406778 306->311 307->295 312 406702 307->312 313 406874-406880 call 406668 308->313 314 406866-406872 call 4065af 308->314 317 4068a3-4068b1 lstrlenW 309->317 318 406896-40689e call 4066a5 309->318 310->311 315 4067b5-4067b8 311->315 316 40677a-4067a1 call 406536 311->316 312->296 329 406885-40688b 313->329 314->329 319 4067c8-4067cb 315->319 320 4067ba-4067c6 GetSystemDirectoryW 315->320 333 40683e-406842 316->333 335 4067a7-4067b0 call 4066a5 316->335 317->307 318->317 326 406834-406836 319->326 327 4067cd-4067db GetWindowsDirectoryW 319->327 325 406838-40683c 320->325 325->333 334 40684f-406855 call 4068ef 325->334 326->325 332 4067dd-4067e5 326->332 327->326 329->317 331 40688d 329->331 331->334 339 4067e7-4067f0 332->339 340 4067fc-406812 SHGetSpecialFolderLocation 332->340 333->334 336 406844-40684a lstrcatW 333->336 334->317 335->325 336->334 345 4067f8-4067fa 339->345 343 406830 340->343 344 406814-40682e SHGetPathFromIDListW CoTaskMemFree 340->344 343->326 344->325 344->343 345->325 345->340
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetSystemDirectoryW.KERNEL32(get,00000400), ref: 004067C0
                                                                                                                                                                                                                          • GetWindowsDirectoryW.KERNEL32(get,00000400,00000000,00422728,?,00405701,00422728,00000000,00000000,00000000,00000000), ref: 004067D3
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Directory$SystemWindowslstrcatlstrlen
                                                                                                                                                                                                                          • String ID: 5957453$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$get
                                                                                                                                                                                                                          • API String ID: 4260037668-3656060252
                                                                                                                                                                                                                          • Opcode ID: a56a8a4d956183f5ceef7ff9e42496adb417aa599aaeb911d527621cdebcfcc9
                                                                                                                                                                                                                          • Instruction ID: 414c90a3e727c3679fd522760d05a71ccfd37451a898d0680c6fb4b4ce958948
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a56a8a4d956183f5ceef7ff9e42496adb417aa599aaeb911d527621cdebcfcc9
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CD61E172A02115EBDB20AF64CD40BAA37A5EF10314F22C13EE946B62D0DB3D49A1CB5D
                                                                                                                                                                                                                          Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 410 40176f-401794 call 402da6 call 405fae 415 401796-40179c call 406668 410->415 416 40179e-4017b0 call 406668 call 405f37 lstrcatW 410->416 421 4017b5-4017b6 call 4068ef 415->421 416->421 425 4017bb-4017bf 421->425 426 4017c1-4017cb call 40699e 425->426 427 4017f2-4017f5 425->427 434 4017dd-4017ef 426->434 435 4017cd-4017db CompareFileTime 426->435 428 4017f7-4017f8 call 406133 427->428 429 4017fd-401819 call 406158 427->429 428->429 437 40181b-40181e 429->437 438 40188d-4018b6 call 4056ca call 403371 429->438 434->427 435->434 439 401820-40185e call 406668 * 2 call 4066a5 call 406668 call 405cc8 437->439 440 40186f-401879 call 4056ca 437->440 450 4018b8-4018bc 438->450 451 4018be-4018ca SetFileTime 438->451 439->425 472 401864-401865 439->472 452 401882-401888 440->452 450->451 454 4018d0-4018db CloseHandle 450->454 451->454 455 402c33 452->455 457 4018e1-4018e4 454->457 458 402c2a-402c2d 454->458 459 402c35-402c39 455->459 462 4018e6-4018f7 call 4066a5 lstrcatW 457->462 463 4018f9-4018fc call 4066a5 457->463 458->455 469 401901-4023a2 call 405cc8 462->469 463->469 469->458 469->459 472->452 474 401867-401868 472->474 474->440
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(00000000,00000000,get,C:\Users\user\PCAppStore,?,?,00000031), ref: 004017B0
                                                                                                                                                                                                                          • CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,C:\Users\user\PCAppStore,?,?,00000031), ref: 004017D5
                                                                                                                                                                                                                            • Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675
                                                                                                                                                                                                                            • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                            • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                            • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\nse5976.tmp$C:\Users\user\AppData\Local\Temp\nse5976.tmp\inetc.dll$C:\Users\user\PCAppStore$get
                                                                                                                                                                                                                          • API String ID: 1941528284-3302978773
                                                                                                                                                                                                                          • Opcode ID: 8a10f81b580edd96727de623d2cb72512ccae63576be40aac63ba19ed1c47bc7
                                                                                                                                                                                                                          • Instruction ID: 87dd38174d63fc88252c3cacf76d35d2aef1a13c6195c1d88e2760da23471212
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8a10f81b580edd96727de623d2cb72512ccae63576be40aac63ba19ed1c47bc7
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DE41B771500205BACF10BBB5CD85DAE7A75EF45328B20473FF422B21E1D63D89619A2E
                                                                                                                                                                                                                          Function 004069C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 476 4069c5-4069e5 GetSystemDirectoryW 477 4069e7 476->477 478 4069e9-4069eb 476->478 477->478 479 4069fc-4069fe 478->479 480 4069ed-4069f6 478->480 482 4069ff-406a32 wsprintfW LoadLibraryExW 479->482 480->479 481 4069f8-4069fa 480->481 481->482
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
                                                                                                                                                                                                                          • wsprintfW.USER32 ref: 00406A17
                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                                                          • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                                                                          • API String ID: 2200240437-1946221925
                                                                                                                                                                                                                          • Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
                                                                                                                                                                                                                          • Instruction ID: e2ac2e7087162e0187f8b4d6776822ec24d6e31928394cf94a41c199a4feb156
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3AF096B154121DA7DB14AB68DD0EF9B366CAB00705F11447EA646F20E0EB7CDA68CB98
                                                                                                                                                                                                                          Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
                                                                                                                                                                                                                          • GlobalFree.KERNEL32(?), ref: 00402A06
                                                                                                                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 00402A19
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2667972263-0
                                                                                                                                                                                                                          • Opcode ID: 3dd095c025195d1a428b75d74b89fb792f772f3b0487a4c6f2200001eeea121b
                                                                                                                                                                                                                          • Instruction ID: 78b93316678d616cb595922dcd62a83f4062aa2fb33f08fb70827f98fa9650ab
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3dd095c025195d1a428b75d74b89fb792f772f3b0487a4c6f2200001eeea121b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E131B171D00124BBCF216FA9CE89D9EBE79AF09364F10023AF461762E1CB794D429B58
                                                                                                                                                                                                                          Function 00405B99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 519 405b99-405be4 CreateDirectoryW 520 405be6-405be8 519->520 521 405bea-405bf7 GetLastError 519->521 522 405c11-405c13 520->522 521->522 523 405bf9-405c0d SetFileSecurityW 521->523 523->520 524 405c0f GetLastError 523->524 524->522
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00405BF0
                                                                                                                                                                                                                          • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405C05
                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00405C0F
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00405BBF
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                          • API String ID: 3449924974-3081826266
                                                                                                                                                                                                                          • Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
                                                                                                                                                                                                                          • Instruction ID: 886f74eda6482ab63e8fe18d08a652fea41827dc0a526659a7d7b5e138c44e4e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 95010871D04219EAEF009FA1CD44BEFBBB8EF14314F04403ADA44B6180E7789648CB99
                                                                                                                                                                                                                          Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 525 40248a-4024bb call 402da6 * 2 call 402e36 532 4024c1-4024cb 525->532 533 402c2a-402c39 525->533 535 4024cd-4024da call 402da6 lstrlenW 532->535 536 4024de-4024e1 532->536 535->536 539 4024e3-4024f4 call 402d84 536->539 540 4024f5-4024f8 536->540 539->540 543 402509-40251d RegSetValueExW 540->543 544 4024fa-402504 call 403371 540->544 546 402522-402603 RegCloseKey 543->546 547 40251f 543->547 544->543 546->533 550 40292e-402935 546->550 547->546 550->533
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nse5976.tmp,00000023,00000011,00000002), ref: 004024D5
                                                                                                                                                                                                                          • RegSetValueExW.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nse5976.tmp,00000000,00000011,00000002), ref: 00402515
                                                                                                                                                                                                                          • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nse5976.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseValuelstrlen
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\nse5976.tmp
                                                                                                                                                                                                                          • API String ID: 2655323295-2305471678
                                                                                                                                                                                                                          • Opcode ID: 0c53a365a9c608e81ef79c85193ab9a3ad89e5c6fa2fbf23b50052b3995ee250
                                                                                                                                                                                                                          • Instruction ID: a516967871aadb8e7373f7254d3c24ec0cdbd982f2b4049ed7d94b0996b6da2b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0c53a365a9c608e81ef79c85193ab9a3ad89e5c6fa2fbf23b50052b3995ee250
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4011AF71E00108BEEF10AFA1CE49EAEB6B8EB44354F11443AF404B61C1DBB98D409658
                                                                                                                                                                                                                          Function 00406187 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 551 406187-406193 552 406194-4061c8 GetTickCount GetTempFileNameW 551->552 553 4061d7-4061d9 552->553 554 4061ca-4061cc 552->554 556 4061d1-4061d4 553->556 554->552 555 4061ce 554->555 555->556
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetTickCount.KERNEL32 ref: 004061A5
                                                                                                                                                                                                                          • GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,?,0040363E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 004061C0
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CountFileNameTempTick
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                                                          • API String ID: 1716503409-678247507
                                                                                                                                                                                                                          • Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
                                                                                                                                                                                                                          • Instruction ID: 21b676f9b33da427d45e0b2d6905a63b6509bf3d89a4e990effff8b21c6fdcbe
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C3F09076700214BFEB008F59DD05E9AB7BCEBA1710F11803AEE05EB180E6B0A9648768
                                                                                                                                                                                                                          Function 00403C25 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 557 403c25-403c34 558 403c40-403c48 557->558 559 403c36-403c39 CloseHandle 557->559 560 403c54-403c60 call 403c82 call 405d74 558->560 561 403c4a-403c4d CloseHandle 558->561 559->558 565 403c65-403c66 560->565 561->560
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C37
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C4B
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • C:\Users\user\AppData\Local\Temp\nse5976.tmp\, xrefs: 00403C5B
                                                                                                                                                                                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2A
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseHandle
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nse5976.tmp\
                                                                                                                                                                                                                          • API String ID: 2962429428-3211766158
                                                                                                                                                                                                                          • Opcode ID: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
                                                                                                                                                                                                                          • Instruction ID: ab9e488bef71b432d29da19662b82269d7b8f1628316f3e3d8f7e3aa77a32ace
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3BE0863244471496E5246F7DAF4D9853B285F413357248726F178F60F0C7389A9B4A9D
                                                                                                                                                                                                                          Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 649 4015c1-4015d5 call 402da6 call 405fe2 654 401631-401634 649->654 655 4015d7-4015ea call 405f64 649->655 656 401663-4022f6 call 401423 654->656 657 401636-401655 call 401423 call 406668 SetCurrentDirectoryW 654->657 662 401604-401607 call 405c16 655->662 663 4015ec-4015ef 655->663 673 402c2a-402c39 656->673 674 40292e-402935 656->674 657->673 676 40165b-40165e 657->676 672 40160c-40160e 662->672 663->662 666 4015f1-4015f8 call 405c33 663->666 666->662 680 4015fa-4015fd call 405b99 666->680 678 401610-401615 672->678 679 401627-40162f 672->679 674->673 676->673 682 401624 678->682 683 401617-401622 GetFileAttributesW 678->683 679->654 679->655 685 401602 680->685 682->679 683->679 683->682 685->672
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0,00000000), ref: 00405FF0
                                                                                                                                                                                                                            • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
                                                                                                                                                                                                                            • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D
                                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
                                                                                                                                                                                                                            • Part of subcall function 00405B99: CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
                                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\PCAppStore,?,00000000,000000F0), ref: 0040164D
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • C:\Users\user\PCAppStore, xrefs: 00401640
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                                                          • String ID: C:\Users\user\PCAppStore
                                                                                                                                                                                                                          • API String ID: 1892508949-1816341478
                                                                                                                                                                                                                          • Opcode ID: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
                                                                                                                                                                                                                          • Instruction ID: a0118e7b9b939ef3ea3e51add98df8039a5aa70d3b8e99a19be4f9c31e9f39fe
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 04112231508105EBCF30AFA0CD4099E36A0EF15329B28493BF901B22F1DB3E4982DB5E
                                                                                                                                                                                                                          Function 0040603F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 686 40603f-40605a call 406668 call 405fe2 691 406060-40606d call 4068ef 686->691 692 40605c-40605e 686->692 696 40607d-406081 691->696 697 40606f-406075 691->697 693 4060b8-4060ba 692->693 699 406097-4060a0 lstrlenW 696->699 697->692 698 406077-40607b 697->698 698->692 698->696 700 4060a2-4060b6 call 405f37 GetFileAttributesW 699->700 701 406083-40608a call 40699e 699->701 700->693 706 406091-406092 call 405f83 701->706 707 40608c-40608f 701->707 706->699 707->692 707->706
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675
                                                                                                                                                                                                                            • Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0,00000000), ref: 00405FF0
                                                                                                                                                                                                                            • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
                                                                                                                                                                                                                            • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0,00000000), ref: 00406098
                                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0), ref: 004060A8
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                                          • String ID: P_B
                                                                                                                                                                                                                          • API String ID: 3248276644-906794629
                                                                                                                                                                                                                          • Opcode ID: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
                                                                                                                                                                                                                          • Instruction ID: df110f430b83b9381375b5fd3fa67f6c4419d4890c6468873e0fced3c2676832
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0DF07826144A1216E622B23A0C05BAF05098F82354B07063FFC93B22E1DF3C8973C43E
                                                                                                                                                                                                                          Function 00407194 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
                                                                                                                                                                                                                          • Instruction ID: 10cc2cc0f2c892254e5285b7a8bac4c216a70fda8fb68dfa7c3680dd08f727d3
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 55A15571E04228DBDF28CFA8C8547ADBBB1FF44305F10842AD856BB281D778A986DF45
                                                                                                                                                                                                                          Function 00407395 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
                                                                                                                                                                                                                          • Instruction ID: d49815ad38d406b3cd0a1a90ea7be1526168d9e39684835ffa6a026ef1ef4849
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 91913270D04228DBEF28CF98C8547ADBBB1FF44305F14816AD856BB281D778A986DF45
                                                                                                                                                                                                                          Function 004070AB Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
                                                                                                                                                                                                                          • Instruction ID: 0a676f48c9952aad729ccf503b6a86ce95496029d8c73069f89f3073be052f6e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C3813471D08228DFDF24CFA8C8847ADBBB1FB44305F24816AD456BB281D778A986DF05
                                                                                                                                                                                                                          Function 00406BB0 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
                                                                                                                                                                                                                          • Instruction ID: 41bbaa2e3590000dceee7c9791d291245bc26db239967492cd44d063337b5de0
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3E814831D08228DBEF28CFA8C8447ADBBB1FF44305F14816AD856B7281D778A986DF45
                                                                                                                                                                                                                          Function 00406FFE Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
                                                                                                                                                                                                                          • Instruction ID: 4a3513360c1d1cc4287bdabe5afcaa460628bed3c0d7ae87261646ca99be8a9f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0D711271D04228DBEF28CF98C9947ADBBF1FB44305F14806AD856B7280D738A986DF05
                                                                                                                                                                                                                          Function 0040711C Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
                                                                                                                                                                                                                          • Instruction ID: aecab3f40db1f9fc07a3dc9ea3777efa7aa3d7dc23f88bc09ddd959c6243594a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2B711571D04228DBEF28CF98C8547ADBBB1FF44305F14806AD856BB281D778A986DF05
                                                                                                                                                                                                                          Function 00407068 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
                                                                                                                                                                                                                          • Instruction ID: 947ff9f4813c08031b822263453b6bbc7859602ae013fffc9a74d3363ad91bbb
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FE713471E04228DBEF28CF98C8547ADBBB1FF44305F15806AD856BB281C778A986DF45
                                                                                                                                                                                                                          Function 00403479 Relevance: 4.6, APIs: 3, Instructions: 101COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetTickCount.KERNEL32 ref: 0040348D
                                                                                                                                                                                                                            • Part of subcall function 004035F8: SetFilePointer.KERNEL32(00000000,00000000,00000000,004032F6,?), ref: 00403606
                                                                                                                                                                                                                          • SetFilePointer.KERNEL32(00000000,00000000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 004034C0
                                                                                                                                                                                                                          • SetFilePointer.KERNEL32(12F86091,00000000,00000000,00414EF0,00004000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000), ref: 004035BB
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FilePointer$CountTick
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1092082344-0
                                                                                                                                                                                                                          • Opcode ID: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
                                                                                                                                                                                                                          • Instruction ID: 4a0f782daef8a724a5dada35133bb9654e3c612a62d69fcdf17392b9264be50a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3A31AEB2650205EFC7209F29EE848263BADF70475A755023BE900B22F1C7B59D42DB9D
                                                                                                                                                                                                                          Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402103
                                                                                                                                                                                                                            • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                            • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                            • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402114
                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 334405425-0
                                                                                                                                                                                                                          • Opcode ID: 52f8d756bd50154f6a3dea7293860066d65bf9effb7e174b318ab9c425843f66
                                                                                                                                                                                                                          • Instruction ID: 1e7e134340f86907485d462c64894228b35b3344cd4f3d252167f9901203d809
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 52f8d756bd50154f6a3dea7293860066d65bf9effb7e174b318ab9c425843f66
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C521C231904104FADF11AFA5CF48A9D7A70BF48354F60413BF605B91E0DBBD8A929A5D
                                                                                                                                                                                                                          Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GlobalFree.KERNEL32(03866988), ref: 00401C0B
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,00000804), ref: 00401C1D
                                                                                                                                                                                                                            • Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                                                            • Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Global$AllocFreelstrcatlstrlen
                                                                                                                                                                                                                          • String ID: get
                                                                                                                                                                                                                          • API String ID: 3292104215-4248514160
                                                                                                                                                                                                                          • Opcode ID: 4319b31a17754bffce461f57a5489b402a00cd847fb6eeae40cdae925115eaf0
                                                                                                                                                                                                                          • Instruction ID: d74cddccbdd50a14e5bf5e3e63826a63b2a65df0fd836753f00777670cd3b466
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4319b31a17754bffce461f57a5489b402a00cd847fb6eeae40cdae925115eaf0
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5321D872904210DBDB20EFA4DEC4E5E73A4AB047157150A3BF542F72D0D6BD9C518BAD
                                                                                                                                                                                                                          Function 0040259E Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
                                                                                                                                                                                                                          • RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E4
                                                                                                                                                                                                                          • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nse5976.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Enum$CloseValue
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 397863658-0
                                                                                                                                                                                                                          • Opcode ID: a2874957321bf6034ab335a01143add9f6f6121a8284cc98450072ad0413cc1f
                                                                                                                                                                                                                          • Instruction ID: fdd171a53236be04b49e80cc8c25aaf428e2db1c32e81cf7e645575326a8d696
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a2874957321bf6034ab335a01143add9f6f6121a8284cc98450072ad0413cc1f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 35017CB1A04105ABEB159F94DE58AAEB66CEF40348F10403AF501B61D0EBB85E45966D
                                                                                                                                                                                                                          Function 00405D2C Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00406133: GetFileAttributesW.KERNEL32(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
                                                                                                                                                                                                                            • Part of subcall function 00406133: SetFileAttributesW.KERNEL32(?,00000000), ref: 0040614C
                                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405F0E), ref: 00405D47
                                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?,?,?,00000000,00405F0E), ref: 00405D4F
                                                                                                                                                                                                                          • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D67
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1655745494-0
                                                                                                                                                                                                                          • Opcode ID: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
                                                                                                                                                                                                                          • Instruction ID: f7500ddcb6900c42920b0fa7cdf939b3a50fd8fb6693fff67202f671924a8b23
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6DE0E531218A9156C3207734AD0CB5B2A98EF86314F09893FF5A2B11E0D77885078AAD
                                                                                                                                                                                                                          Function 004021AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • C:\Users\user\PCAppStore, xrefs: 00402269
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CreateInstance
                                                                                                                                                                                                                          • String ID: C:\Users\user\PCAppStore
                                                                                                                                                                                                                          • API String ID: 542301482-1816341478
                                                                                                                                                                                                                          • Opcode ID: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
                                                                                                                                                                                                                          • Instruction ID: f110e38d5ccd8909b9e85e2ea6b1342c5fae2602ce40754bea02e3b472428d32
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BC411771A00209EFCF40DFE4C989E9D7BB5BF49304B20456AF505EB2D1DB799981CB94
                                                                                                                                                                                                                          Function 004064D5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,?,?,00422728,?,('B,00406563,('B,00000000,?,?,get,?), ref: 004064F9
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Open
                                                                                                                                                                                                                          • String ID: ('B
                                                                                                                                                                                                                          • API String ID: 71445658-2332581011
                                                                                                                                                                                                                          • Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                                                          • Instruction ID: 5036765eb4ab6e58186d81024f5778724aa2024cd81e2e1d5ca813995cf5404a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BAD0123210020DBBDF115F90AD01FAB375DAB08310F018426FE06A4092D775D534A728
                                                                                                                                                                                                                          Function 00403371 Relevance: 3.1, APIs: 2, Instructions: 88COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 00403396
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FilePointer
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 973152223-0
                                                                                                                                                                                                                          • Opcode ID: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
                                                                                                                                                                                                                          • Instruction ID: 963a71f16df831595788c30304fa9cedbf2cad19eb63879c1ada4fe15c9ed8fa
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 93319F70200219EFDB129F65ED84E9A3FA8FF00355B10443AF905EA1A1D778CE51DBA9
                                                                                                                                                                                                                          Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
                                                                                                                                                                                                                          • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nse5976.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseQueryValue
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3356406503-0
                                                                                                                                                                                                                          • Opcode ID: 2f519eafec3af35988992028302c1fe2ffbfb85c9afca13b7af9384ace0fec36
                                                                                                                                                                                                                          • Instruction ID: eaee0c709954dca67eb2d1c59e66f6ca2c08a593dad46a4828cc6951ae7b5872
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2f519eafec3af35988992028302c1fe2ffbfb85c9afca13b7af9384ace0fec36
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5C116D71900219EBDF14DFA4DE589AE7774FF04345B20443BE401B62D0E7B88A45EB5D
                                                                                                                                                                                                                          Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3850602802-0
                                                                                                                                                                                                                          • Opcode ID: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
                                                                                                                                                                                                                          • Instruction ID: af17251ef12b8b272b5eaf8d1bef107274ce64b6e67bb2dd4604cf2723900e86
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6F012831724220EBEB295B389D05B6A3698E710714F10857FF855F76F1E678CC029B6D
                                                                                                                                                                                                                          Function 00405C4B Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000,00000000), ref: 00405C74
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?), ref: 00405C81
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3712363035-0
                                                                                                                                                                                                                          • Opcode ID: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
                                                                                                                                                                                                                          • Instruction ID: 91309136e62a13352d93043ad9bb7922807806bb2ea2f765c8e9c4a894a003d9
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 59E0B6B4600209BFFB109B64EE09F7B7BADFB04648F414565BD51F2190D778A8158A78
                                                                                                                                                                                                                          Function 00406A35 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
                                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 00406A62
                                                                                                                                                                                                                            • Part of subcall function 004069C5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
                                                                                                                                                                                                                            • Part of subcall function 004069C5: wsprintfW.USER32 ref: 00406A17
                                                                                                                                                                                                                            • Part of subcall function 004069C5: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2547128583-0
                                                                                                                                                                                                                          • Opcode ID: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
                                                                                                                                                                                                                          • Instruction ID: 0464b4a7853edb7079d0776797c383171681067eb8499b99987f1e8ea9f8efb8
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E0E086727042106AD210A6745D08D3773E8ABC6711307883EF557F2040D738DC359A79
                                                                                                                                                                                                                          Function 00403C82 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,74DF3420,00000000,74DF2EE0,00403C59,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C9C
                                                                                                                                                                                                                          • GlobalFree.KERNEL32(?), ref: 00403CA3
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Free$GlobalLibrary
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1100898210-0
                                                                                                                                                                                                                          • Opcode ID: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
                                                                                                                                                                                                                          • Instruction ID: 1b4b668df254a36c82b8f96f79c5ae0e05fb6c29bd97d86a5de4613e9375b038
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0AE08C335052205BD6211F55EA0875A7768AF94B26F06006AE980BB26087781C424BC8
                                                                                                                                                                                                                          Function 00406158 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nsb5A9.tmp,80000000,00000003), ref: 0040615C
                                                                                                                                                                                                                          • CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: File$AttributesCreate
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 415043291-0
                                                                                                                                                                                                                          • Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
                                                                                                                                                                                                                          • Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19
                                                                                                                                                                                                                          Function 00406133 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
                                                                                                                                                                                                                          • SetFileAttributesW.KERNEL32(?,00000000), ref: 0040614C
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: AttributesFile
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3188754299-0
                                                                                                                                                                                                                          • Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                                                          • Instruction ID: 3e6336b5c460747e2e1e0fbe3c4db8defb42c0044e1a92967a1d29a512d2a4bc
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 73D0C972514130ABC2102728AE0889ABB56EB64271B014A35F9A5A62B0CB304C628A98
                                                                                                                                                                                                                          Function 00405C16 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00405C2A
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1375471231-0
                                                                                                                                                                                                                          • Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
                                                                                                                                                                                                                          • Instruction ID: 66e62c5d6c7775ff4cea72667941029308d228c48495a605f612c1d2d9e1fc74
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FBC04C31218605AEE7605B219F0CB177A94DB50741F114839E186F40A0DA788455D92D
                                                                                                                                                                                                                          Function 00406503 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 0040652C
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Create
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2289755597-0
                                                                                                                                                                                                                          • Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                                                          • Instruction ID: 390987c888b9fe28ccc3a202ccefe0e129b8fdbaba7b34d45eb5723cdb444700
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C1E0ECB2010109BEEF099F90EC0ADBB372DEB04704F41492EF907E4091E6B5AE70AA34
                                                                                                                                                                                                                          Function 0040620A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000,00412A94,0040CEF0,00403579,0040CEF0,00412A94,00414EF0,00004000,?,00000000,004033A3,00000004), ref: 0040621E
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FileWrite
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3934441357-0
                                                                                                                                                                                                                          • Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                                                          • Instruction ID: 398385dbb58ca0a44fa402a726e0ab0b2131cea3ae709c8a1b666252059dd88a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F6E08632141129EBCF10AE548C00EEB375CFB01350F014476F955E3040D330E93087A5
                                                                                                                                                                                                                          Function 004061DB Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • ReadFile.KERNEL32(?,00000000,00000000,00000000,00000000,00414EF0,0040CEF0,004035F5,?,?,004034F9,00414EF0,00004000,?,00000000,004033A3), ref: 004061EF
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FileRead
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2738559852-0
                                                                                                                                                                                                                          • Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                                                          • Instruction ID: 689b8facb1381159ac92aeccc4703b7db47ce2620db9a14c340ec3ef8a35c8b1
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C1E0863250021AABDF10AE518C04AEB375CEB01360F014477F922E2150D230E82187E8
                                                                                                                                                                                                                          Function 004035F8 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SetFilePointer.KERNEL32(00000000,00000000,00000000,004032F6,?), ref: 00403606
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FilePointer
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 973152223-0
                                                                                                                                                                                                                          • Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                                                          • Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D
                                                                                                                                                                                                                          Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                            • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                            • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                            • Part of subcall function 00405C4B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000,00000000), ref: 00405C74
                                                                                                                                                                                                                            • Part of subcall function 00405C4B: CloseHandle.KERNEL32(?), ref: 00405C81
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB
                                                                                                                                                                                                                            • Part of subcall function 00406AE0: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406AF1
                                                                                                                                                                                                                            • Part of subcall function 00406AE0: GetExitCodeProcess.KERNEL32(?,?), ref: 00406B13
                                                                                                                                                                                                                            • Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2972824698-0
                                                                                                                                                                                                                          • Opcode ID: 39558c5643c496eaffaca9d6483fe6d6b72d5b00fb47a50e88cd8089dc569f6d
                                                                                                                                                                                                                          • Instruction ID: 7fe263eab699b123ac8c37dffe14ee58438593542e676086741668bd6549bbba
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 39558c5643c496eaffaca9d6483fe6d6b72d5b00fb47a50e88cd8089dc569f6d
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3DF09072905112EBDF21BBA59AC4DAE76A4DF01318B25453BE102B21E0D77C4E528A6E

                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                          Function 00405809 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000403), ref: 00405867
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003EE), ref: 00405876
                                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 004058B3
                                                                                                                                                                                                                          • GetSystemMetrics.USER32(00000002), ref: 004058BA
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001061,00000000,?), ref: 004058DB
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004058EC
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004058FF
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040590D
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405920
                                                                                                                                                                                                                          • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405942
                                                                                                                                                                                                                          • ShowWindow.USER32(?,00000008), ref: 00405956
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003EC), ref: 00405977
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405987
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059A0
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004059AC
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003F8), ref: 00405885
                                                                                                                                                                                                                            • Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003EC), ref: 004059C9
                                                                                                                                                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_0000579D,00000000), ref: 004059D7
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 004059DE
                                                                                                                                                                                                                          • ShowWindow.USER32(00000000), ref: 00405A02
                                                                                                                                                                                                                          • ShowWindow.USER32(?,00000008), ref: 00405A07
                                                                                                                                                                                                                          • ShowWindow.USER32(00000008), ref: 00405A51
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405A85
                                                                                                                                                                                                                          • CreatePopupMenu.USER32 ref: 00405A96
                                                                                                                                                                                                                          • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405AAA
                                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00405ACA
                                                                                                                                                                                                                          • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405AE3
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B1B
                                                                                                                                                                                                                          • OpenClipboard.USER32(00000000), ref: 00405B2B
                                                                                                                                                                                                                          • EmptyClipboard.USER32 ref: 00405B31
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B3D
                                                                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00405B47
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B5B
                                                                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00405B7B
                                                                                                                                                                                                                          • SetClipboardData.USER32(0000000D,00000000), ref: 00405B86
                                                                                                                                                                                                                          • CloseClipboard.USER32 ref: 00405B8C
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                                          • String ID: H7B${
                                                                                                                                                                                                                          • API String ID: 590372296-2256286769
                                                                                                                                                                                                                          • Opcode ID: 0185fb71cb0ebac8bb253ddb79263eb6e3c4c27c477fa06c1930d1494c9be16a
                                                                                                                                                                                                                          • Instruction ID: d0bbb34d81c2c7a38b5cdb5171fa906e4f4201ee6cbe22cb0b3272b57562556b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0185fb71cb0ebac8bb253ddb79263eb6e3c4c27c477fa06c1930d1494c9be16a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D8B137B0900608FFDF119FA0DD89AAE7B79FB08354F00417AFA45A61A0CB755E52DF68
                                                                                                                                                                                                                          Function 00405031 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003F9), ref: 00405049
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000408), ref: 00405054
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,?), ref: 0040509E
                                                                                                                                                                                                                          • LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 004050B5
                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000FC,0040563E), ref: 004050CE
                                                                                                                                                                                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004050E2
                                                                                                                                                                                                                          • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004050F4
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001109,00000002), ref: 0040510A
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405116
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405128
                                                                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 0040512B
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405156
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405162
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001132,00000000,?), ref: 004051FD
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040522D
                                                                                                                                                                                                                            • Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001132,00000000,?), ref: 00405241
                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0040526F
                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040527D
                                                                                                                                                                                                                          • ShowWindow.USER32(?,00000005), ref: 0040528D
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000419,00000000,?), ref: 00405388
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004053ED
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405402
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405426
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405446
                                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0040545B
                                                                                                                                                                                                                          • GlobalFree.KERNEL32(?), ref: 0040546B
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004054E4
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001102,?,?), ref: 0040558D
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040559C
                                                                                                                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 004055C7
                                                                                                                                                                                                                          • ShowWindow.USER32(?,00000000), ref: 00405615
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003FE), ref: 00405620
                                                                                                                                                                                                                          • ShowWindow.USER32(00000000), ref: 00405627
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                                          • String ID: $M$N
                                                                                                                                                                                                                          • API String ID: 2564846305-813528018
                                                                                                                                                                                                                          • Opcode ID: 950969970af6d10ef62121ad67a768569704eb6391eae900e1ce4f9d1827afee
                                                                                                                                                                                                                          • Instruction ID: a1eb65f7683e17450fca8d4cb4c1055b074660be5b1b810df034ff690b7f681c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 950969970af6d10ef62121ad67a768569704eb6391eae900e1ce4f9d1827afee
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2A025CB0900609EFDF20DF65CD45AAE7BB5FB44315F10817AEA10BA2E1D7798A52CF18
                                                                                                                                                                                                                          Function 004040C5 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404101
                                                                                                                                                                                                                          • ShowWindow.USER32(?), ref: 00404121
                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00404133
                                                                                                                                                                                                                          • ShowWindow.USER32(?,00000004), ref: 0040414C
                                                                                                                                                                                                                          • DestroyWindow.USER32 ref: 00404160
                                                                                                                                                                                                                          • SetWindowLongW.USER32(?,00000000,00000000), ref: 00404179
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,?), ref: 00404198
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004041AC
                                                                                                                                                                                                                          • IsWindowEnabled.USER32(00000000), ref: 004041B3
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000001), ref: 0040425E
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000002), ref: 00404268
                                                                                                                                                                                                                          • SetClassLongW.USER32(?,000000F2,?), ref: 00404282
                                                                                                                                                                                                                          • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004042D3
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000003), ref: 00404379
                                                                                                                                                                                                                          • ShowWindow.USER32(00000000,?), ref: 0040439A
                                                                                                                                                                                                                          • EnableWindow.USER32(?,?), ref: 004043AC
                                                                                                                                                                                                                          • EnableWindow.USER32(?,?), ref: 004043C7
                                                                                                                                                                                                                          • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004043DD
                                                                                                                                                                                                                          • EnableMenuItem.USER32(00000000), ref: 004043E4
                                                                                                                                                                                                                          • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004043FC
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040440F
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404439
                                                                                                                                                                                                                          • SetWindowTextW.USER32(?,00423748), ref: 0040444D
                                                                                                                                                                                                                          • ShowWindow.USER32(?,0000000A), ref: 00404581
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
                                                                                                                                                                                                                          • String ID: H7B
                                                                                                                                                                                                                          • API String ID: 1860320154-2300413410
                                                                                                                                                                                                                          • Opcode ID: 2f4dad2f818047668635e16f952da299a81014d83ff1599baf972819d0fbfd0c
                                                                                                                                                                                                                          • Instruction ID: 1d4a55fced449df2e2a9dfc159c1061f424388fbea236c5341ec002980a30b6c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2f4dad2f818047668635e16f952da299a81014d83ff1599baf972819d0fbfd0c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C0C1C2B1600604FBDB216F61EE85E2A3B78EB85745F40097EF781B51F0CB3958529B2E
                                                                                                                                                                                                                          Function 00404783 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404821
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003E8), ref: 00404835
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404852
                                                                                                                                                                                                                          • GetSysColor.USER32(?), ref: 00404863
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404871
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040487F
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(?), ref: 00404884
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404891
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004048A6
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,0000040A), ref: 004048FF
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000), ref: 00404906
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003E8), ref: 00404931
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404974
                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 00404982
                                                                                                                                                                                                                          • SetCursor.USER32(00000000), ref: 00404985
                                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 0040499E
                                                                                                                                                                                                                          • SetCursor.USER32(00000000), ref: 004049A1
                                                                                                                                                                                                                          • SendMessageW.USER32(00000111,00000001,00000000), ref: 004049D0
                                                                                                                                                                                                                          • SendMessageW.USER32(00000010,00000000,00000000), ref: 004049E2
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                                                                                                                                                          • String ID: N$get
                                                                                                                                                                                                                          • API String ID: 3103080414-214687294
                                                                                                                                                                                                                          • Opcode ID: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
                                                                                                                                                                                                                          • Instruction ID: 690b4d321b533a2a97605fa3f7bb2423a24794fe1ec6c961d913f822d5f12d1b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AB6181F1900209FFDB109F61CD85A6A7B69FB84304F00813AF705B62E0C7799951DFA9
                                                                                                                                                                                                                          Function 00404AB5 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 275stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003FB), ref: 00404B04
                                                                                                                                                                                                                          • SetWindowTextW.USER32(00000000,?), ref: 00404B2E
                                                                                                                                                                                                                          • SHBrowseForFolderW.SHELL32(?), ref: 00404BDF
                                                                                                                                                                                                                          • CoTaskMemFree.OLE32(00000000), ref: 00404BEA
                                                                                                                                                                                                                          • lstrcmpiW.KERNEL32(get,00423748,00000000,?,?), ref: 00404C1C
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(?,get), ref: 00404C28
                                                                                                                                                                                                                          • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404C3A
                                                                                                                                                                                                                            • Part of subcall function 00405CAC: GetDlgItemTextW.USER32(?,?,00000400,00404C71), ref: 00405CBF
                                                                                                                                                                                                                            • Part of subcall function 004068EF: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
                                                                                                                                                                                                                            • Part of subcall function 004068EF: CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
                                                                                                                                                                                                                            • Part of subcall function 004068EF: CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
                                                                                                                                                                                                                            • Part of subcall function 004068EF: CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979
                                                                                                                                                                                                                          • GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404CFD
                                                                                                                                                                                                                          • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404D18
                                                                                                                                                                                                                            • Part of subcall function 00404E71: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
                                                                                                                                                                                                                            • Part of subcall function 00404E71: wsprintfW.USER32 ref: 00404F1B
                                                                                                                                                                                                                            • Part of subcall function 00404E71: SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                          • String ID: 5957453$A$C:\Users\user\PCAppStore$H7B$get
                                                                                                                                                                                                                          • API String ID: 2624150263-4207246097
                                                                                                                                                                                                                          • Opcode ID: 667bbe0a30595837a03e9c6ce466c2f6c83f7bc5ead90454ae6c6de6e9a81711
                                                                                                                                                                                                                          • Instruction ID: 9155a42c54a3203d4d9709c494e168d8d926bd307d67cbb08bf4d9f42020e7e3
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 667bbe0a30595837a03e9c6ce466c2f6c83f7bc5ead90454ae6c6de6e9a81711
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 94A171F1900219ABDB11EFA5CD41AAFB7B8EF84315F11843BF601B62D1D77C8A418B69
                                                                                                                                                                                                                          Function 004062AE Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130memorystringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406449,?,?), ref: 004062E9
                                                                                                                                                                                                                          • GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 004062F2
                                                                                                                                                                                                                            • Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
                                                                                                                                                                                                                            • Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF
                                                                                                                                                                                                                          • GetShortPathNameW.KERNEL32(?,004275E8,00000400), ref: 0040630F
                                                                                                                                                                                                                          • wsprintfA.USER32 ref: 0040632D
                                                                                                                                                                                                                          • GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406368
                                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406377
                                                                                                                                                                                                                          • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063AF
                                                                                                                                                                                                                          • SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 00406405
                                                                                                                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 00406416
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040641D
                                                                                                                                                                                                                            • Part of subcall function 00406158: GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nsb5A9.tmp,80000000,00000003), ref: 0040615C
                                                                                                                                                                                                                            • Part of subcall function 00406158: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                                                                                                                                                          • String ID: %ls=%ls$[Rename]$mB$uB$uB
                                                                                                                                                                                                                          • API String ID: 2171350718-2295842750
                                                                                                                                                                                                                          • Opcode ID: 07ea5d3dd502240bf86d0c298f94c43ad2335bec49c481c59c36197298e6ebad
                                                                                                                                                                                                                          • Instruction ID: df9b4e9fb9d32bd4c250032a1d399944af7a2e4c2f0bdec2b7d3959d12e60cc8
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 07ea5d3dd502240bf86d0c298f94c43ad2335bec49c481c59c36197298e6ebad
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B8314331200315BBD2206B619D49F5B3AACEF85704F16003BFD02FA2C2EA7DD82186BD
                                                                                                                                                                                                                          Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                                          • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                                          • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                                          • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                                          • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                                                          • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                                          • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                                                          • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                                          • DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                                          • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                                          • String ID: F
                                                                                                                                                                                                                          • API String ID: 941294808-1304234792
                                                                                                                                                                                                                          • Opcode ID: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
                                                                                                                                                                                                                          • Instruction ID: e2f9fea5dfd6f059ba8eeb08e8d10ac227d01a2162b8a260283931f50cd0bfbf
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 33418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7349A55DFA4
                                                                                                                                                                                                                          Function 004056CA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                          • SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                            • Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                                                            • Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSendlstrlen$lstrcat$TextWindow
                                                                                                                                                                                                                          • String ID: ('B
                                                                                                                                                                                                                          • API String ID: 1495540970-2332581011
                                                                                                                                                                                                                          • Opcode ID: da0887550f177a20a5adca650a80eb3065253b4758cf57a6ba66e38fd01475e6
                                                                                                                                                                                                                          • Instruction ID: 7f52a71d89202be05388d2ae90ba5930d13dcc1e6093ad3ff4eaa481a322a782
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: da0887550f177a20a5adca650a80eb3065253b4758cf57a6ba66e38fd01475e6
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C6217A71900518FACB119FA5DD84A8EBFB8EB45360F10857AF904B62A0D67A4A509F68
                                                                                                                                                                                                                          Function 0040462B Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000EB), ref: 00404648
                                                                                                                                                                                                                          • GetSysColor.USER32(00000000), ref: 00404686
                                                                                                                                                                                                                          • SetTextColor.GDI32(?,00000000), ref: 00404692
                                                                                                                                                                                                                          • SetBkMode.GDI32(?,?), ref: 0040469E
                                                                                                                                                                                                                          • GetSysColor.USER32(?), ref: 004046B1
                                                                                                                                                                                                                          • SetBkColor.GDI32(?,?), ref: 004046C1
                                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 004046DB
                                                                                                                                                                                                                          • CreateBrushIndirect.GDI32(?), ref: 004046E5
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2320649405-0
                                                                                                                                                                                                                          • Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                                                          • Instruction ID: e78b8cc9c8042372c9a7340b9b8aa9b23ded286a9f8ddc7240a2e2d8bd1f46c0
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DE2197715007049FC7309F28D908B5BBBF8AF42714F008D2EE992A22E1D739D944DB58
                                                                                                                                                                                                                          Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • ReadFile.KERNEL32(?,?,?,?), ref: 00402758
                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
                                                                                                                                                                                                                          • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
                                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC
                                                                                                                                                                                                                            • Part of subcall function 00406239: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040624F
                                                                                                                                                                                                                          • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                                                          • String ID: 9
                                                                                                                                                                                                                          • API String ID: 163830602-2366072709
                                                                                                                                                                                                                          • Opcode ID: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
                                                                                                                                                                                                                          • Instruction ID: 581cf2785626502de532f206a1de9da9d9b8d20bcd24121b7f7bd1133decb9a2
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CE51FB75D00219AADF20EF95CA88AAEBB75FF04304F50417BE541B62D4D7B49D82CB58
                                                                                                                                                                                                                          Function 004068EF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
                                                                                                                                                                                                                          • CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
                                                                                                                                                                                                                          • CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
                                                                                                                                                                                                                          • CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Char$Next$Prev
                                                                                                                                                                                                                          • String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                          • API String ID: 589700163-4010320282
                                                                                                                                                                                                                          • Opcode ID: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
                                                                                                                                                                                                                          • Instruction ID: d28fb8c2eefe6f61a155ceb01790bbf8b21f4710aa7989e54d8eeb8481a577c9
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2611089580061295DB303B18CC40BB762F8AF99B50F12403FE98A776C1E77C4C9286BD
                                                                                                                                                                                                                          Function 0040302E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • DestroyWindow.USER32(00000000,00000000), ref: 00403049
                                                                                                                                                                                                                          • GetTickCount.KERNEL32 ref: 00403067
                                                                                                                                                                                                                          • wsprintfW.USER32 ref: 00403095
                                                                                                                                                                                                                            • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                            • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                            • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                            • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                          • CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 004030B9
                                                                                                                                                                                                                          • ShowWindow.USER32(00000000,00000005), ref: 004030C7
                                                                                                                                                                                                                            • Part of subcall function 00403012: MulDiv.KERNEL32(00000000,00000064,00015C8B), ref: 00403027
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
                                                                                                                                                                                                                          • String ID: ... %d%%
                                                                                                                                                                                                                          • API String ID: 722711167-2449383134
                                                                                                                                                                                                                          • Opcode ID: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
                                                                                                                                                                                                                          • Instruction ID: 5af6bf9b0b70cf9307c1258d0e5a667b07be53d22b58a3258066d7aee54b172b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E8018E70553614DBC7317F60AE08A5A3EACAB00F06F54457AF841B21E9DAB84645CBAE
                                                                                                                                                                                                                          Function 00404F7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404F9A
                                                                                                                                                                                                                          • GetMessagePos.USER32 ref: 00404FA2
                                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00404FBC
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404FCE
                                                                                                                                                                                                                          • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404FF4
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                                          • String ID: f
                                                                                                                                                                                                                          • API String ID: 41195575-1993550816
                                                                                                                                                                                                                          • Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                                                          • Instruction ID: ce4c7d6d39dceca23aa6ebdb29af7737867007859e7bede0b388bd4d525dd41f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3C014C71940219BADB00DBA4DD85BFEBBB8AF54711F10012BBB50B61C0D6B49A058BA5
                                                                                                                                                                                                                          Function 00402F93 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
                                                                                                                                                                                                                          • wsprintfW.USER32 ref: 00402FE5
                                                                                                                                                                                                                          • SetWindowTextW.USER32(?,?), ref: 00402FF5
                                                                                                                                                                                                                          • SetDlgItemTextW.USER32(?,00000406,?), ref: 00403007
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                                          • String ID: unpacking data: %d%%$verifying installer: %d%%
                                                                                                                                                                                                                          • API String ID: 1451636040-1158693248
                                                                                                                                                                                                                          • Opcode ID: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
                                                                                                                                                                                                                          • Instruction ID: 34ad84b97f90b05cf42cbebec4ee1aaae98efe268bf46a139428006d78f28757
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 25F0497050020DABEF246F60DD49BEA3B69FB00309F00803AFA05B51D0DFBD9A559F59
                                                                                                                                                                                                                          Function 00404E71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
                                                                                                                                                                                                                          • wsprintfW.USER32 ref: 00404F1B
                                                                                                                                                                                                                          • SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                                          • String ID: %u.%u%s%s$H7B
                                                                                                                                                                                                                          • API String ID: 3540041739-107966168
                                                                                                                                                                                                                          • Opcode ID: 2edccdcb36c72f9bdce7a586f7ca7ee262dfb9f9a49697097ea36a1117f17e36
                                                                                                                                                                                                                          • Instruction ID: 20619224473e8c08b4fba53027c62ddcf1c3fef784a2ba69f514aa474de30786
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2edccdcb36c72f9bdce7a586f7ca7ee262dfb9f9a49697097ea36a1117f17e36
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1A11D8736041283BDB00A5ADDC45E9F3298AB81338F150637FA26F61D1EA79882182E8
                                                                                                                                                                                                                          Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
                                                                                                                                                                                                                          • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
                                                                                                                                                                                                                          • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseEnum$DeleteValue
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1354259210-0
                                                                                                                                                                                                                          • Opcode ID: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
                                                                                                                                                                                                                          • Instruction ID: 37c7ba0f9c491dd7f389852fcb35a119484072d927876f68e32cbd91f0a54eef
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6D216B7150010ABBDF11AF94CE89EEF7B7DEB50384F110076F909B21E0D7B49E54AA68
                                                                                                                                                                                                                          Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetDlgItem.USER32(?,?), ref: 00401D9A
                                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 00401DE5
                                                                                                                                                                                                                          • LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
                                                                                                                                                                                                                          • SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
                                                                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 00401E39
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1849352358-0
                                                                                                                                                                                                                          • Opcode ID: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
                                                                                                                                                                                                                          • Instruction ID: 4d725fdcf847a80329c23b38d7164c003567f542edd6fcacfb34c9ebeef40da9
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 67212672904119AFCB05CBA4DE45AEEBBB5EF08304F14003AF945F62A0CB389951DB98
                                                                                                                                                                                                                          Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetDC.USER32(?), ref: 00401E51
                                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
                                                                                                                                                                                                                          • MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
                                                                                                                                                                                                                          • ReleaseDC.USER32(?,00000000), ref: 00401E84
                                                                                                                                                                                                                            • Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                                                            • Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                                                          • CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2584051700-0
                                                                                                                                                                                                                          • Opcode ID: e128970cf71a0b284ce18b21917758e509e5717976d06807f88455f58f814df6
                                                                                                                                                                                                                          • Instruction ID: b9cc094806d22c325402cb6ccb5f5134c2025175c414775df3ff87de861ccae2
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e128970cf71a0b284ce18b21917758e509e5717976d06807f88455f58f814df6
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8401B571900241EFEB005BB4EE89A9A3FB0AB15301F208939F541B71D2C6B904459BED
                                                                                                                                                                                                                          Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
                                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessageSend$Timeout
                                                                                                                                                                                                                          • String ID: !
                                                                                                                                                                                                                          • API String ID: 1777923405-2657877971
                                                                                                                                                                                                                          • Opcode ID: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
                                                                                                                                                                                                                          • Instruction ID: e1c20d37316975b9b94706f7b3abd8da4b7b3b5136eece5bd2aa3cbae88a6c19
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 28219E7190420AEFEF05AFA4D94AAAE7BB4FF44304F14453EF601B61D0D7B88941CB98
                                                                                                                                                                                                                          Function 00406536 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,0040A230,00000000,('B,00000000,?,?,get,?,?,0040679D,80000002), ref: 0040657C
                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,0040679D,80000002,Software\Microsoft\Windows\CurrentVersion,get,get,get,00000000,00422728), ref: 00406587
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseQueryValue
                                                                                                                                                                                                                          • String ID: ('B$get
                                                                                                                                                                                                                          • API String ID: 3356406503-1955485993
                                                                                                                                                                                                                          • Opcode ID: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
                                                                                                                                                                                                                          • Instruction ID: 52dd0fe420a7c1e2827d1a164217834099ee72e945ce70567094b216899e5676
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C4017C72500209FADF21CF51DD09EDB3BA8EF54364F01803AFD1AA2190D738D964DBA4
                                                                                                                                                                                                                          Function 00405F37 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F3D
                                                                                                                                                                                                                          • CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F47
                                                                                                                                                                                                                          • lstrcatW.KERNEL32(?,0040A014), ref: 00405F59
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • C:\Users\user\AppData\Local\Temp\, xrefs: 00405F37
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                          • API String ID: 2659869361-3081826266
                                                                                                                                                                                                                          • Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                                                          • Instruction ID: 9007417a49851ea4d61da9c71e51c63d156abd36d345156a737e00ee84923012
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 59D05E611019246AC111AB548D04DDB63ACAE85304742046AF601B60A0CB7E196287ED
                                                                                                                                                                                                                          Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nse5976.tmp\inetc.dll), ref: 00402695
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: lstrlen
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp\nse5976.tmp$C:\Users\user\AppData\Local\Temp\nse5976.tmp\inetc.dll
                                                                                                                                                                                                                          • API String ID: 1659193697-1437454246
                                                                                                                                                                                                                          • Opcode ID: 9a86cc41fb3ba1d07c106fca7ec167276fc7dee72b5d11bed2732143b2a4cd05
                                                                                                                                                                                                                          • Instruction ID: f1e3379d491753f9d96dc3c217618d2e64da59e9cc8309568291ba5d2d488428
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9a86cc41fb3ba1d07c106fca7ec167276fc7dee72b5d11bed2732143b2a4cd05
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D511C472A00205EBCB10BBB18E4AA9E76619F44758F21483FE402B61C1DAFD8891965F
                                                                                                                                                                                                                          Function 0040563E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • IsWindowVisible.USER32(?), ref: 0040566D
                                                                                                                                                                                                                          • CallWindowProcW.USER32(?,?,?,?), ref: 004056BE
                                                                                                                                                                                                                            • Part of subcall function 00404610: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3748168415-3916222277
                                                                                                                                                                                                                          • Opcode ID: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
                                                                                                                                                                                                                          • Instruction ID: 537e1cae7e4c88fb21f4f8cfd237bdd46b0b38e99f2a5e053ca6ba0093d9a5c8
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4401B171200608AFEF205F11DD84A6B3A35EB84361F904837FA08752E0D77F8D929E6D
                                                                                                                                                                                                                          Function 00405F83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrlenW.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,0040313C,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nsb5A9.tmp,C:\Users\user\AppData\Local\Temp\nsb5A9.tmp,80000000,00000003), ref: 00405F89
                                                                                                                                                                                                                          • CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,0040313C,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nsb5A9.tmp,C:\Users\user\AppData\Local\Temp\nsb5A9.tmp,80000000,00000003), ref: 00405F99
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • C:\Users\user\AppData\Local\Temp, xrefs: 00405F83
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CharPrevlstrlen
                                                                                                                                                                                                                          • String ID: C:\Users\user\AppData\Local\Temp
                                                                                                                                                                                                                          • API String ID: 2709904686-47812868
                                                                                                                                                                                                                          • Opcode ID: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
                                                                                                                                                                                                                          • Instruction ID: bd974b3f77e4b05eb9372a1ad14375fba7b947cfa10dd8d614d5bb7090e452f7
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6CD05EB2401D219EC3126B04DC00D9F63ACEF51301B4A4866E441AB1A0DB7C5D9186A9
                                                                                                                                                                                                                          Function 004060BD Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
                                                                                                                                                                                                                          • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004060E5
                                                                                                                                                                                                                          • CharNextA.USER32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060F6
                                                                                                                                                                                                                          • lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 00000009.00000002.2512972215.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512942611.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2512999954.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513025772.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 00000009.00000002.2513427592.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_9_2_400000_nsb5A9.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 190613189-0
                                                                                                                                                                                                                          • Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
                                                                                                                                                                                                                          • Instruction ID: 2f06b96f93541eceebcae48a9adfe7aedd37cb678349478f8cad11de2473fd3e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0BF0F631104054FFDB12DFA4CD00D9EBBA8EF06350B2640BAE841FB321D674DE11A798

                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                          Execution Coverage:14%
                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                          Signature Coverage:4.2%
                                                                                                                                                                                                                          Total number of Nodes:2000
                                                                                                                                                                                                                          Total number of Limit Nodes:46
                                                                                                                                                                                                                          execution_graph 68988 7ff660ac51f0 68991 7ff660ac4ef0 68988->68991 68990 7ff660ac51fc 68994 7ff660ac4e70 68991->68994 68995 7ff660ac4e96 std::bad_exception::bad_exception 68994->68995 69002 7ff660a92c70 68995->69002 69030 7ff660c813e8 69002->69030 69004 7ff660a92c94 _Yarn 69005 7ff660a92d09 69004->69005 69006 7ff660a92d1b 69004->69006 69034 7ff660c8200c 18 API calls std::_Locinfo::_Locinfo_ctor 69005->69034 69035 7ff660c818e0 51 API calls 2 library calls 69006->69035 69009 7ff660a92d18 69010 7ff660ac73c0 69009->69010 69037 7ff660aa0020 69010->69037 69013 7ff660a94b10 69117 7ff660c82078 69013->69117 69018 7ff660a93a50 std::bad_exception::bad_exception 13 API calls 69019 7ff660a94b46 69018->69019 69020 7ff660a93a50 std::bad_exception::bad_exception 13 API calls 69019->69020 69021 7ff660a94b57 69020->69021 69022 7ff660a93a50 std::bad_exception::bad_exception 13 API calls 69021->69022 69023 7ff660a94b68 69022->69023 69024 7ff660a93a50 std::bad_exception::bad_exception 13 API calls 69023->69024 69025 7ff660a94b79 69024->69025 69026 7ff660a93a50 std::bad_exception::bad_exception 13 API calls 69025->69026 69027 7ff660a94b8a 69026->69027 69124 7ff660c81460 69027->69124 69029 7ff660a94b97 69029->68990 69031 7ff660c813f7 69030->69031 69032 7ff660c813fc 69030->69032 69036 7ff660cba794 6 API calls std::_Lockit::_Lockit 69031->69036 69032->69004 69035->69009 69040 7ff660c82390 69037->69040 69049 7ff660cbab18 69040->69049 69048 7ff660aa003a 69048->69013 69065 7ff660cc09fc GetLastError 69049->69065 69054 7ff660cbabac 69055 7ff660cc09fc _Getctype 47 API calls 69054->69055 69056 7ff660cbabb5 69055->69056 69057 7ff660cc0e70 _Getctype 47 API calls 69056->69057 69058 7ff660c823bc 69057->69058 69059 7ff660cbab78 69058->69059 69060 7ff660cc09fc _Getctype 47 API calls 69059->69060 69061 7ff660cbab81 69060->69061 69062 7ff660cc0e70 _Getctype 47 API calls 69061->69062 69063 7ff660c823c4 69062->69063 69063->69048 69064 7ff660cbaae8 47 API calls _Getctype 69063->69064 69064->69048 69066 7ff660cc0a20 FlsGetValue 69065->69066 69067 7ff660cc0a3d FlsSetValue 69065->69067 69068 7ff660cc0a37 69066->69068 69085 7ff660cc0a2d 69066->69085 69069 7ff660cc0a4f 69067->69069 69067->69085 69068->69067 69091 7ff660cc0d5c 69069->69091 69070 7ff660cc0aa9 SetLastError 69072 7ff660cc0ac9 69070->69072 69073 7ff660cbab21 69070->69073 69105 7ff660cafd98 47 API calls __std_fs_directory_iterator_open 69072->69105 69087 7ff660cc0e70 69073->69087 69076 7ff660cc0a7c FlsSetValue 69080 7ff660cc0a88 FlsSetValue 69076->69080 69081 7ff660cc0a9a 69076->69081 69077 7ff660cc0a6c FlsSetValue 69079 7ff660cc0a75 69077->69079 69098 7ff660cc0dd4 69079->69098 69080->69079 69104 7ff660cc07ac 11 API calls _get_daylight 69081->69104 69084 7ff660cc0aa2 69086 7ff660cc0dd4 __free_lconv_mon 11 API calls 69084->69086 69085->69070 69086->69070 69088 7ff660cc0e85 69087->69088 69090 7ff660c823b5 69087->69090 69088->69090 69116 7ff660ccd80c 47 API calls 3 library calls 69088->69116 69090->69054 69096 7ff660cc0d6d _get_daylight 69091->69096 69092 7ff660cc0dbe 69109 7ff660ca90f0 11 API calls _get_daylight 69092->69109 69093 7ff660cc0da2 HeapAlloc 69094 7ff660cc0a5e 69093->69094 69093->69096 69094->69076 69094->69077 69096->69092 69096->69093 69106 7ff660cbfffc 69096->69106 69099 7ff660cc0dd9 HeapFree 69098->69099 69101 7ff660cc0e0a 69098->69101 69100 7ff660cc0df4 GetLastError 69099->69100 69099->69101 69102 7ff660cc0e01 __free_lconv_mon 69100->69102 69101->69085 69115 7ff660ca90f0 11 API calls _get_daylight 69102->69115 69104->69084 69110 7ff660cc003c 69106->69110 69109->69094 69111 7ff660cba724 std::_Locinfo::_Locinfo_ctor EnterCriticalSection 69110->69111 69112 7ff660cc0049 69111->69112 69113 7ff660cba778 std::_Locinfo::_Locinfo_ctor LeaveCriticalSection 69112->69113 69114 7ff660cc000e 69113->69114 69114->69096 69115->69101 69116->69090 69118 7ff660a94b23 69117->69118 69119 7ff660c82085 69117->69119 69121 7ff660a93a50 69118->69121 69128 7ff660cbaa9c 7 API calls 2 library calls 69119->69128 69129 7ff660aa2360 69121->69129 69125 7ff660c8146b LeaveCriticalSection 69124->69125 69127 7ff660c81474 69124->69127 69127->69029 69128->69118 69130 7ff660a93a63 69129->69130 69131 7ff660aa2374 69129->69131 69130->69018 69133 7ff660ca9ad0 69131->69133 69134 7ff660cc0dd4 69133->69134 69135 7ff660cc0e0a 69134->69135 69136 7ff660cc0dd9 HeapFree 69134->69136 69135->69130 69136->69135 69137 7ff660cc0df4 GetLastError 69136->69137 69138 7ff660cc0e01 __free_lconv_mon 69137->69138 69140 7ff660ca90f0 11 API calls _get_daylight 69138->69140 69140->69135 69141 7ff660a8d5f0 69142 7ff660a8d608 operator== SafeRWList _aligned_msize type_info::_name_internal_method 69141->69142 69147 7ff660a8fba0 69142->69147 69146 7ff660a8d659 69152 7ff660a9b130 69147->69152 69227 7ff660a9afb0 69147->69227 69148 7ff660a8d654 69151 7ff660c81a54 60 API calls std::_Throw_Cpp_error 69148->69151 69151->69146 69246 7ff660a911a0 69152->69246 69160 7ff660a9b1fd operator== UnDecorator::getVbTableType 69161 7ff660a9b227 RegisterClassExW 69160->69161 69162 7ff660a9b24d 69161->69162 69170 7ff660a9b23d UnDecorator::getVbTableType 69161->69170 69163 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 69162->69163 69164 7ff660a9b283 69163->69164 69165 7ff660ad8e90 70 API calls 69164->69165 69166 7ff660a9b2a0 operator== 69165->69166 69167 7ff660a9b2b5 CreateWindowExW 69166->69167 69168 7ff660a9b33a UnDecorator::getVbTableType 69167->69168 69169 7ff660a9b35a ShowWindow 69168->69169 69168->69170 69171 7ff660a9b384 69169->69171 69170->69148 69314 7ff660aac710 69171->69314 69173 7ff660a9b3bb 69318 7ff660aac1b0 69173->69318 69175 7ff660a9b3cd 69176 7ff660a911a0 _Mpunct 51 API calls 69175->69176 69177 7ff660a9b40b 69176->69177 69178 7ff660ad98a0 70 API calls 69177->69178 69179 7ff660a9b428 69178->69179 69180 7ff660a911a0 _Mpunct 51 API calls 69179->69180 69228 7ff660a911a0 _Mpunct 51 API calls 69227->69228 69229 7ff660a9afda 69228->69229 69230 7ff660ad98a0 70 API calls 69229->69230 69231 7ff660a9afee operator== 69230->69231 69232 7ff660a911a0 _Mpunct 51 API calls 69231->69232 69233 7ff660a9b014 UnDecorator::getVbTableType 69232->69233 69234 7ff660a910b0 51 API calls 69233->69234 69235 7ff660a9b03c operator== 69234->69235 69236 7ff660a9b05f OpenEventW 69235->69236 69238 7ff660a9b07e UnDecorator::getVbTableType 69236->69238 69712 7ff660c5f160 69238->69712 69929 7ff660c60140 69238->69929 69241 7ff660a9b0a8 69242 7ff660a9b0b0 CloseHandle 69241->69242 69243 7ff660a9b0bc 69241->69243 69242->69243 69244 7ff660a93c10 shared_ptr 47 API calls 69243->69244 69245 7ff660a9b0c6 69244->69245 69245->69148 69247 7ff660a911c7 SafeRWList _Mpunct _WChar_traits 69246->69247 69414 7ff660a8b440 69247->69414 69249 7ff660a911ec 69250 7ff660ad98a0 69249->69250 69251 7ff660a911a0 _Mpunct 51 API calls 69250->69251 69252 7ff660ad98cd 69251->69252 69422 7ff660ad8170 69252->69422 69261 7ff660a93c10 shared_ptr 47 API calls 69262 7ff660ad9943 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 69261->69262 69441 7ff660ad89d0 69262->69441 69264 7ff660ad9a29 Concurrency::details::WorkQueue::IsStructuredEmpty 69454 7ff660a904b0 69264->69454 69267 7ff660ad997b shared_ptr 69267->69264 69466 7ff660ad8200 47 API calls 69267->69466 69467 7ff660ad9cd0 51 API calls 2 library calls 69267->69467 69271 7ff660ad9a58 69272 7ff660a93c10 shared_ptr 47 API calls 69271->69272 69273 7ff660ad9a66 69272->69273 69274 7ff660a93c10 shared_ptr 47 API calls 69273->69274 69275 7ff660ad9a74 69274->69275 69276 7ff660a93c10 shared_ptr 47 API calls 69275->69276 69277 7ff660a9b17b 69276->69277 69278 7ff660a90450 69277->69278 69580 7ff660a90380 69278->69580 69280 7ff660a9046d 69281 7ff660ad8e90 69280->69281 69282 7ff660ad8eb6 operator== 69281->69282 69283 7ff660a911a0 _Mpunct 51 API calls 69282->69283 69284 7ff660ad8ec6 69283->69284 69285 7ff660a93c10 shared_ptr 47 API calls 69284->69285 69288 7ff660ad8eea shared_ptr 69285->69288 69287 7ff660ad8fab 69289 7ff660ad8fbc 69287->69289 69295 7ff660ad9007 SafeRWList 69287->69295 69613 7ff660ad8610 69288->69613 69625 7ff660a905d0 69289->69625 69294 7ff660a93be0 std::ios_base::failure::failure 47 API calls 69297 7ff660ad8fec UnDecorator::getVbTableType 69294->69297 69633 7ff660a897a0 69295->69633 69297->69160 69298 7ff660ad909d SafeRWList 69299 7ff660a897a0 51 API calls 69298->69299 69300 7ff660ad9152 69299->69300 69301 7ff660ad9e60 51 API calls 69300->69301 69302 7ff660ad9170 Concurrency::details::WorkQueue::IsStructuredEmpty 69301->69302 69637 7ff660a90510 69302->69637 69305 7ff660a93c10 shared_ptr 47 API calls 69306 7ff660ad91bd 69305->69306 69307 7ff660a93c10 shared_ptr 47 API calls 69306->69307 69308 7ff660ad91cb 69307->69308 69309 7ff660a93c10 shared_ptr 47 API calls 69308->69309 69310 7ff660ad91d9 69309->69310 69311 7ff660ad7fa0 47 API calls 69310->69311 69312 7ff660ad91e4 69311->69312 69313 7ff660a93be0 std::ios_base::failure::failure 47 API calls 69312->69313 69313->69297 69315 7ff660aac72e Concurrency::details::HardwareAffinity::operator!= 69314->69315 69317 7ff660aac73f 69315->69317 69655 7ff660aa2e10 69315->69655 69317->69173 69319 7ff660aac1cf 69318->69319 69320 7ff660aac1d4 69318->69320 69319->69175 69320->69319 69321 7ff660aac1f9 69320->69321 69323 7ff660aac24c Concurrency::details::WorkQueue::IsStructuredEmpty 69320->69323 69660 7ff660a8dcd0 51 API calls 6 library calls 69321->69660 69323->69319 69661 7ff660a9ecb0 47 API calls 4 library calls 69323->69661 69415 7ff660a8b467 _Mpunct 69414->69415 69418 7ff660a8b473 Concurrency::details::WorkQueue::IsStructuredEmpty std::_Throw_Cpp_error _Mpunct 69415->69418 69420 7ff660aa2970 51 API calls std::_Throw_Cpp_error 69415->69420 69417 7ff660a8b4ac std::_Throw_Cpp_error SafeRWList type_info::_name_internal_method shared_ptr char_traits 69417->69249 69418->69417 69421 7ff660a8aff0 49 API calls _Mpunct 69418->69421 69420->69418 69421->69417 69427 7ff660ad818f 69422->69427 69423 7ff660ad81c7 69426 7ff660a93c10 shared_ptr 47 API calls 69423->69426 69428 7ff660ad81eb 69426->69428 69427->69423 69468 7ff660ad8200 47 API calls 69427->69468 69469 7ff660ac6690 51 API calls 69427->69469 69429 7ff660ad85c0 69428->69429 69430 7ff660ad85e9 Concurrency::details::WorkQueue::IsStructuredEmpty 69429->69430 69470 7ff660aa2d10 69430->69470 69432 7ff660ad8602 69433 7ff660ad9e60 69432->69433 69434 7ff660a910b0 51 API calls 69433->69434 69435 7ff660ad9e90 Concurrency::details::HardwareAffinity::operator!= 69434->69435 69436 7ff660a93c10 shared_ptr 47 API calls 69435->69436 69437 7ff660ad9914 69436->69437 69438 7ff660ad8140 69437->69438 69439 7ff660ad85c0 type_info::_name_internal_method 51 API calls 69438->69439 69440 7ff660ad815d 69439->69440 69440->69261 69475 7ff660a90f30 69441->69475 69443 7ff660ad89ff 69451 7ff660ad8b8e 69443->69451 69479 7ff660ad8110 51 API calls Concurrency::task_continuation_context::task_continuation_context 69443->69479 69444 7ff660ad8ce7 std::_Throw_Cpp_error 69445 7ff660a93be0 std::ios_base::failure::failure 47 API calls 69444->69445 69446 7ff660ad8d0e 69445->69446 69448 7ff660a93be0 std::ios_base::failure::failure 47 API calls 69446->69448 69447 7ff660ad8cbf 69447->69444 69481 7ff660ad8110 51 API calls Concurrency::task_continuation_context::task_continuation_context 69447->69481 69450 7ff660ad8d19 69448->69450 69450->69267 69451->69444 69451->69447 69480 7ff660ad8110 51 API calls Concurrency::task_continuation_context::task_continuation_context 69451->69480 69506 7ff660a9a5a0 69454->69506 69458 7ff660a904d0 69513 7ff660a983e0 69458->69513 69461 7ff660a904f6 69463 7ff660a93be0 69461->69463 69575 7ff660aa2760 69463->69575 69465 7ff660a93bf3 std::ios_base::failure::failure 69465->69271 69466->69267 69467->69267 69468->69427 69469->69427 69471 7ff660aa2dcf 69470->69471 69473 7ff660aa2d4e Concurrency::details::WorkQueue::IsStructuredEmpty type_info::_name_internal_method char_traits 69470->69473 69474 7ff660a8de60 51 API calls 6 library calls 69471->69474 69473->69432 69474->69473 69476 7ff660a90f57 SafeRWList _Mpunct char_traits 69475->69476 69482 7ff660a8b5d0 69476->69482 69478 7ff660a90f7c 69478->69443 69479->69443 69480->69451 69481->69447 69483 7ff660a8b5f7 std::_Throw_Cpp_error 69482->69483 69485 7ff660a8b603 Concurrency::details::WorkQueue::IsStructuredEmpty std::_Throw_Cpp_error 69483->69485 69491 7ff660aa2970 51 API calls std::_Throw_Cpp_error 69483->69491 69487 7ff660a8b63c std::_Throw_Cpp_error SafeRWList shared_ptr char_traits 69485->69487 69488 7ff660a8af90 69485->69488 69487->69478 69492 7ff660a8af30 69488->69492 69491->69485 69495 7ff660aa29b0 69492->69495 69496 7ff660aa29c8 allocator 69495->69496 69499 7ff660a8aef0 69496->69499 69500 7ff660a8af01 69499->69500 69501 7ff660a8af05 69499->69501 69500->69487 69502 7ff660a8af10 69501->69502 69503 7ff660a8af1c 69501->69503 69504 7ff660a8b050 allocator 49 API calls 69502->69504 69505 7ff660a9eb90 allocator RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 69503->69505 69504->69500 69505->69500 69530 7ff660a9a620 69506->69530 69509 7ff660a903d0 69510 7ff660a903de 69509->69510 69510->69510 69512 7ff660a9041e UnDecorator::getVbTableType 69510->69512 69548 7ff660a98370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 69510->69548 69512->69458 69514 7ff660a904e0 69513->69514 69515 7ff660a983fb 69513->69515 69514->69461 69517 7ff660a94f80 69514->69517 69515->69514 69549 7ff660a9a8e0 56 API calls 69515->69549 69518 7ff660a94f96 69517->69518 69520 7ff660a94fa0 69517->69520 69550 7ff660a9a4a0 69518->69550 69521 7ff660a94ffa 69520->69521 69522 7ff660a94fbd 69520->69522 69560 7ff660a99650 RtlPcToFileHeader RaiseException std::ios_base::good UnDecorator::getVbTableType 69521->69560 69553 7ff660a9a510 69522->69553 69525 7ff660a94ff7 69525->69461 69528 7ff660a94fe9 69557 7ff660a9ae00 69528->69557 69531 7ff660a9a649 69530->69531 69532 7ff660a9a68b 69530->69532 69546 7ff660ca2efc AcquireSRWLockExclusive SleepConditionVariableSRW ReleaseSRWLockExclusive 69531->69546 69533 7ff660a904c3 69532->69533 69547 7ff660ca2efc AcquireSRWLockExclusive SleepConditionVariableSRW ReleaseSRWLockExclusive 69532->69547 69533->69509 69548->69510 69549->69514 69561 7ff660a9ebb0 69550->69561 69552 7ff660a9a4ae MultiByteToWideChar 69552->69520 69562 7ff660a9aa90 69553->69562 69556 7ff660a98690 MultiByteToWideChar 69556->69528 69570 7ff660a9c0d0 69557->69570 69559 7ff660a9ae1b 69559->69525 69560->69525 69561->69552 69563 7ff660a9aaa4 69562->69563 69565 7ff660a9aaae std::ios_base::good 69562->69565 69568 7ff660a98370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 69563->69568 69566 7ff660a94fcb 69565->69566 69569 7ff660a9a9c0 49 API calls 2 library calls 69565->69569 69566->69556 69568->69565 69569->69566 69572 7ff660a9c0e4 std::ios_base::good 69570->69572 69573 7ff660a9c101 std::ios_base::good 69572->69573 69574 7ff660a98370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 69572->69574 69573->69559 69574->69573 69576 7ff660aa277d Concurrency::details::WorkQueue::IsStructuredEmpty shared_ptr 69575->69576 69578 7ff660aa27b9 shared_ptr char_traits 69576->69578 69579 7ff660a9f380 47 API calls shared_ptr 69576->69579 69578->69465 69579->69578 69581 7ff660a90398 std::ios_base::good 69580->69581 69584 7ff660a98440 69581->69584 69583 7ff660a903a7 UnDecorator::getVbTableType 69583->69280 69585 7ff660a98468 UnDecorator::getVbTableType 69584->69585 69587 7ff660a9848d UnDecorator::getVbTableType 69585->69587 69588 7ff660a984e0 UnDecorator::getVbTableType 69585->69588 69590 7ff660a9ea20 RtlPcToFileHeader RaiseException strrchr 69585->69590 69587->69583 69591 7ff660ab0d40 69588->69591 69590->69588 69592 7ff660ab0d67 69591->69592 69596 7ff660ab0d60 memcpy_s 69591->69596 69593 7ff660ab0d90 69592->69593 69598 7ff660ab0daa memcpy_s 69592->69598 69607 7ff660ca90f0 11 API calls _get_daylight 69593->69607 69595 7ff660ab0d95 69608 7ff660ca8f84 47 API calls _invalid_parameter_noinfo_noreturn 69595->69608 69596->69587 69598->69596 69599 7ff660ab0dfd 69598->69599 69603 7ff660ab0e14 69598->69603 69609 7ff660ca90f0 11 API calls _get_daylight 69599->69609 69601 7ff660ab0e02 69610 7ff660ca8f84 47 API calls _invalid_parameter_noinfo_noreturn 69601->69610 69603->69596 69611 7ff660ca90f0 11 API calls _get_daylight 69603->69611 69605 7ff660ab0e46 69612 7ff660ca8f84 47 API calls _invalid_parameter_noinfo_noreturn 69605->69612 69607->69595 69608->69596 69609->69601 69610->69596 69611->69605 69612->69596 69614 7ff660a90f30 _Mpunct 51 API calls 69613->69614 69624 7ff660ad863a Concurrency::details::HardwareAffinity::operator!= 69614->69624 69615 7ff660ad8981 69616 7ff660ad7fa0 47 API calls 69615->69616 69618 7ff660ad89a8 69616->69618 69617 7ff660ad8838 69617->69615 69648 7ff660ad9e00 51 API calls 69617->69648 69620 7ff660a93be0 std::ios_base::failure::failure 47 API calls 69618->69620 69621 7ff660ad89b3 69620->69621 69621->69287 69624->69617 69646 7ff660ad9d60 50 API calls 69624->69646 69647 7ff660ad9e00 51 API calls 69624->69647 69626 7ff660a9a5a0 57 API calls 69625->69626 69627 7ff660a905de 69626->69627 69628 7ff660a903d0 2 API calls 69627->69628 69629 7ff660a905eb 69628->69629 69630 7ff660ad7fa0 69629->69630 69649 7ff660ad84f0 69630->69649 69634 7ff660a897d6 Concurrency::cancellation_token::_FromImpl SafeRWList ctype 69633->69634 69635 7ff660a8b440 _Mpunct 51 API calls 69634->69635 69636 7ff660a89810 Concurrency::cancellation_token::_FromImpl 69634->69636 69635->69636 69636->69298 69638 7ff660a9a5a0 57 API calls 69637->69638 69639 7ff660a90523 69638->69639 69640 7ff660a903d0 2 API calls 69639->69640 69641 7ff660a90530 69640->69641 69642 7ff660a983e0 56 API calls 69641->69642 69644 7ff660a90540 69642->69644 69643 7ff660a90556 69643->69305 69644->69643 69654 7ff660a95010 49 API calls UnDecorator::getVbTableType 69644->69654 69646->69624 69647->69624 69648->69617 69651 7ff660ad8503 Concurrency::details::WorkQueue::IsStructuredEmpty shared_ptr 69649->69651 69650 7ff660ad7fb3 69650->69294 69651->69650 69653 7ff660aa4850 47 API calls type_info::_name_internal_method 69651->69653 69653->69650 69654->69643 69656 7ff660aa2ed1 69655->69656 69658 7ff660aa2e4f Concurrency::details::WorkQueue::IsStructuredEmpty char_traits 69655->69658 69659 7ff660a8e3f0 51 API calls 6 library calls 69656->69659 69658->69317 69659->69658 69660->69319 69661->69319 69713 7ff660a90f30 _Mpunct 51 API calls 69712->69713 69714 7ff660c5f18e 69713->69714 70146 7ff660ad9aa0 69714->70146 69717 7ff660a90f30 _Mpunct 51 API calls 69718 7ff660c5f1d0 69717->69718 69719 7ff660ad9aa0 59 API calls 69718->69719 69720 7ff660c5f1ed 69719->69720 69721 7ff660a90f30 _Mpunct 51 API calls 69720->69721 69722 7ff660c5f212 69721->69722 69723 7ff660ad9aa0 59 API calls 69722->69723 69724 7ff660c5f22f 69723->69724 69725 7ff660a90f30 _Mpunct 51 API calls 69724->69725 69726 7ff660c5f254 69725->69726 69727 7ff660ad9aa0 59 API calls 69726->69727 69728 7ff660c5f271 69727->69728 69729 7ff660a90f30 _Mpunct 51 API calls 69728->69729 69730 7ff660c5f296 69729->69730 69731 7ff660ad9aa0 59 API calls 69730->69731 69732 7ff660c5f2b3 69731->69732 70176 7ff660a90e90 69732->70176 69930 7ff660a90f30 _Mpunct 51 API calls 69929->69930 69931 7ff660c6016e 69930->69931 69932 7ff660ad9aa0 59 API calls 69931->69932 69933 7ff660c6018b 69932->69933 69934 7ff660a90f30 _Mpunct 51 API calls 69933->69934 69935 7ff660c601b0 69934->69935 69936 7ff660ad9aa0 59 API calls 69935->69936 69937 7ff660c601cd 69936->69937 69938 7ff660a90f30 _Mpunct 51 API calls 69937->69938 69939 7ff660c601f2 69938->69939 69940 7ff660ad9aa0 59 API calls 69939->69940 69941 7ff660c6020f 69940->69941 69942 7ff660a90f30 _Mpunct 51 API calls 69941->69942 69943 7ff660c60234 69942->69943 69944 7ff660ad9aa0 59 API calls 69943->69944 69945 7ff660c60251 69944->69945 69946 7ff660a90f30 _Mpunct 51 API calls 69945->69946 69947 7ff660c60276 69946->69947 69948 7ff660ad9aa0 59 API calls 69947->69948 69949 7ff660c60293 69948->69949 69950 7ff660a90e90 std::_Throw_Cpp_error 51 API calls 69949->69950 69951 7ff660c602b9 69950->69951 69952 7ff660ad9580 54 API calls 69951->69952 69953 7ff660c602d6 69952->69953 69954 7ff660b1f8f0 54 API calls 69953->69954 69955 7ff660c60306 69954->69955 69956 7ff660c5caf0 52 API calls 69955->69956 69957 7ff660c60338 69956->69957 69958 7ff660b188f0 51 API calls 69957->69958 69959 7ff660c6036d 69958->69959 69960 7ff660ab9140 shared_ptr 47 API calls 69959->69960 69961 7ff660c6037b 69960->69961 69962 7ff660ab9140 shared_ptr 47 API calls 69961->69962 69963 7ff660c60389 69962->69963 69964 7ff660a93be0 std::ios_base::failure::failure 47 API calls 69963->69964 69965 7ff660c60397 69964->69965 69966 7ff660c67830 99 API calls 69965->69966 69967 7ff660c603b8 69966->69967 69968 7ff660a90e90 std::_Throw_Cpp_error 51 API calls 69967->69968 69969 7ff660c603de 69968->69969 69970 7ff660ad9580 54 API calls 69969->69970 69971 7ff660c603fb 69970->69971 69972 7ff660b1f8f0 54 API calls 69971->69972 69973 7ff660c6042b 69972->69973 69974 7ff660b188f0 51 API calls 69973->69974 69975 7ff660c60449 69974->69975 69976 7ff660b0bf80 75 API calls 69975->69976 69977 7ff660c6046e 69976->69977 69978 7ff660ab9140 shared_ptr 47 API calls 69977->69978 69979 7ff660c6047f 69978->69979 69980 7ff660ab9140 shared_ptr 47 API calls 69979->69980 69981 7ff660c6048d 69980->69981 69982 7ff660a93be0 std::ios_base::failure::failure 47 API calls 69981->69982 69983 7ff660c6049b 69982->69983 69984 7ff660c6058f 69983->69984 69985 7ff660a90e90 std::_Throw_Cpp_error 51 API calls 69983->69985 69986 7ff660a90e90 std::_Throw_Cpp_error 51 API calls 69984->69986 69987 7ff660c604cd 69985->69987 69988 7ff660c605b5 69986->69988 69990 7ff660ad9580 54 API calls 69987->69990 69989 7ff660ad9580 54 API calls 69988->69989 69992 7ff660c605d2 69989->69992 69991 7ff660c604ea 69990->69991 69993 7ff660b1f8f0 54 API calls 69991->69993 69994 7ff660b1f8f0 54 API calls 69992->69994 69995 7ff660c6051a 69993->69995 69996 7ff660c60602 69994->69996 69997 7ff660b188f0 51 API calls 69995->69997 69998 7ff660b188f0 51 API calls 69996->69998 69999 7ff660c60538 69997->69999 70000 7ff660c60620 69998->70000 71120 7ff660c67d20 51 API calls SafeRWList 69999->71120 70002 7ff660b0bf80 75 API calls 70000->70002 70004 7ff660c60645 70002->70004 70003 7ff660c60565 70005 7ff660ab9140 shared_ptr 47 API calls 70003->70005 70006 7ff660ab9140 shared_ptr 47 API calls 70004->70006 70007 7ff660c60573 70005->70007 70008 7ff660c60656 70006->70008 70009 7ff660ab9140 shared_ptr 47 API calls 70007->70009 70010 7ff660ab9140 shared_ptr 47 API calls 70008->70010 70011 7ff660c60581 70009->70011 70012 7ff660c60664 70010->70012 70013 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70011->70013 70014 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70012->70014 70013->69984 70015 7ff660c60672 70014->70015 70016 7ff660a90e90 std::_Throw_Cpp_error 51 API calls 70015->70016 70022 7ff660c60766 HandleT Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 70015->70022 70017 7ff660c606a4 70016->70017 70018 7ff660ad9580 54 API calls 70017->70018 70019 7ff660c606c1 70018->70019 70020 7ff660b1f8f0 54 API calls 70019->70020 70021 7ff660c606f1 70020->70021 70023 7ff660b188f0 51 API calls 70021->70023 70024 7ff660a90e90 std::_Throw_Cpp_error 51 API calls 70022->70024 70027 7ff660c60a6d 70022->70027 70025 7ff660c6070f 70023->70025 70026 7ff660c607e7 70024->70026 71121 7ff660c67d20 51 API calls SafeRWList 70025->71121 70029 7ff660ad9580 54 API calls 70026->70029 70031 7ff660a911a0 _Mpunct 51 API calls 70027->70031 70145 7ff660c6104d UnDecorator::getVbTableType 70027->70145 70033 7ff660c60804 70029->70033 70030 7ff660c5c450 47 API calls 70034 7ff660c610a9 70030->70034 70035 7ff660c60aac 70031->70035 70032 7ff660c6073c 70036 7ff660ab9140 shared_ptr 47 API calls 70032->70036 70037 7ff660b1f8f0 54 API calls 70033->70037 70038 7ff660c5c430 47 API calls 70034->70038 70039 7ff660ad98a0 70 API calls 70035->70039 70040 7ff660c6074a 70036->70040 70041 7ff660c60834 70037->70041 70042 7ff660c610b4 70038->70042 70043 7ff660c60ac9 70039->70043 70044 7ff660ab9140 shared_ptr 47 API calls 70040->70044 70045 7ff660b188f0 51 API calls 70041->70045 70046 7ff660ab9140 shared_ptr 47 API calls 70042->70046 70047 7ff660a911a0 _Mpunct 51 API calls 70043->70047 70048 7ff660c60758 70044->70048 70049 7ff660c6084f 70045->70049 70050 7ff660c610c2 70046->70050 70051 7ff660c60aee 70047->70051 70052 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70048->70052 70053 7ff660b0bf80 75 API calls 70049->70053 70054 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70050->70054 70055 7ff660ad98a0 70 API calls 70051->70055 70052->70022 70056 7ff660c60874 70053->70056 70058 7ff660c610d0 70054->70058 70059 7ff660c60b0b 70055->70059 70057 7ff660ab9140 shared_ptr 47 API calls 70056->70057 70060 7ff660c60885 70057->70060 70061 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70058->70061 70062 7ff660a911a0 _Mpunct 51 API calls 70059->70062 70064 7ff660ab9140 shared_ptr 47 API calls 70060->70064 70065 7ff660c610de 70061->70065 70063 7ff660c60b30 70062->70063 70066 7ff660ad98a0 70 API calls 70063->70066 70067 7ff660c60893 70064->70067 70068 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70065->70068 70069 7ff660c60b4d 70066->70069 70070 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70067->70070 70071 7ff660c610ec 70068->70071 70072 7ff660a911a0 _Mpunct 51 API calls 70069->70072 70073 7ff660c608a1 70070->70073 70074 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70071->70074 70075 7ff660c60b72 70072->70075 70073->70027 70078 7ff660a90e90 std::_Throw_Cpp_error 51 API calls 70073->70078 70076 7ff660c610fa 70074->70076 70077 7ff660ad98a0 70 API calls 70075->70077 70079 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70076->70079 70084 7ff660c60b8f 70077->70084 70080 7ff660c608d3 70078->70080 70081 7ff660a9b089 WaitForSingleObject 70079->70081 70082 7ff660ad9580 54 API calls 70080->70082 70081->69238 70081->69241 70083 7ff660c608f0 70082->70083 70085 7ff660b1f8f0 54 API calls 70083->70085 71123 7ff660c5b4e0 47 API calls 70084->71123 70086 7ff660c60920 70085->70086 70088 7ff660b188f0 51 API calls 70086->70088 70089 7ff660c6093b 70088->70089 70090 7ff660c67270 120 API calls 70089->70090 70091 7ff660c60968 70090->70091 70092 7ff660ab9140 shared_ptr 47 API calls 70091->70092 70093 7ff660c60976 70092->70093 70094 7ff660ab9140 shared_ptr 47 API calls 70093->70094 70096 7ff660c60984 70094->70096 70095 7ff660c60bdf 71124 7ff660c5b760 47 API calls 70095->71124 70098 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70096->70098 70102 7ff660c60992 70098->70102 70099 7ff660c60c42 71125 7ff660c67e90 51 API calls 70099->71125 70101 7ff660c60c96 70103 7ff660a905d0 59 API calls 70101->70103 71122 7ff660c5b360 51 API calls 2 library calls 70102->71122 70105 7ff660c60ca1 70103->70105 70107 7ff660a911a0 _Mpunct 51 API calls 70105->70107 70106 7ff660c60a5f 70108 7ff660c5c430 47 API calls 70106->70108 70109 7ff660c60cc6 70107->70109 70108->70027 70110 7ff660ad98a0 70 API calls 70109->70110 70111 7ff660c60ce0 70110->70111 71126 7ff660c55480 51 API calls 2 library calls 70111->71126 70113 7ff660c60cf3 71127 7ff660abc650 51 API calls 3 library calls 70113->71127 70115 7ff660c60d1f Concurrency::details::WorkQueue::IsStructuredEmpty 70116 7ff660a904b0 68 API calls 70115->70116 70117 7ff660c60d54 70116->70117 70118 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70117->70118 70119 7ff660c60da1 70118->70119 70120 7ff660ad8e90 70 API calls 70119->70120 70121 7ff660c60dbe operator== 70120->70121 70122 7ff660a9a250 68 API calls 70121->70122 70123 7ff660c60e05 UnDecorator::getVbTableType 70122->70123 70124 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70123->70124 70125 7ff660c60e2f 70124->70125 70126 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70125->70126 70127 7ff660c60e55 70126->70127 70128 7ff660ad8e90 70 API calls 70127->70128 70129 7ff660c60e72 70128->70129 70145->70030 70147 7ff660a911a0 _Mpunct 51 API calls 70146->70147 70148 7ff660ad9acd 70147->70148 70149 7ff660ad8170 51 API calls 70148->70149 70150 7ff660ad9ae0 70149->70150 70151 7ff660ad85c0 type_info::_name_internal_method 51 API calls 70150->70151 70152 7ff660ad9af6 70151->70152 70403 7ff660accad0 70152->70403 70155 7ff660ad9e60 51 API calls 70156 7ff660ad9b35 70155->70156 70157 7ff660ad8140 type_info::_name_internal_method 51 API calls 70156->70157 70158 7ff660ad9b56 70157->70158 70159 7ff660a93c10 shared_ptr 47 API calls 70158->70159 70160 7ff660ad9b64 70159->70160 70161 7ff660a93c10 shared_ptr 47 API calls 70160->70161 70162 7ff660ad9b72 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 70161->70162 70163 7ff660ad89d0 51 API calls 70162->70163 70164 7ff660ad9bad shared_ptr 70163->70164 70165 7ff660ad9c64 std::_Throw_Cpp_error 70164->70165 70412 7ff660ad8200 47 API calls 70164->70412 70413 7ff660ad9cd0 51 API calls 2 library calls 70164->70413 70167 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70165->70167 70168 7ff660ad9c91 70167->70168 70170 7ff660a93c10 shared_ptr 47 API calls 70168->70170 70171 7ff660ad9c9f 70170->70171 70172 7ff660a93c10 shared_ptr 47 API calls 70171->70172 70173 7ff660ad9cad 70172->70173 70174 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70173->70174 70175 7ff660ad9cbb 70174->70175 70175->69717 70177 7ff660a90eb2 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::cancellation_token::_FromImpl _aligned_msize 70176->70177 70500 7ff660a8b760 70177->70500 70179 7ff660a90f16 70180 7ff660ad9580 70179->70180 70184 7ff660ad95ab shared_ptr 70180->70184 70181 7ff660ad8610 54 API calls 70182 7ff660ad9659 70181->70182 70183 7ff660ad966a 70182->70183 70188 7ff660ad96a7 SafeRWList 70182->70188 70185 7ff660ad7fa0 47 API calls 70183->70185 70184->70181 70186 7ff660ad968c 70185->70186 70187 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70186->70187 70204 7ff660ad969a 70187->70204 70189 7ff660a897a0 51 API calls 70188->70189 70190 7ff660ad973d SafeRWList 70189->70190 70191 7ff660a897a0 51 API calls 70190->70191 70192 7ff660ad97f2 70191->70192 70193 7ff660ad9e60 51 API calls 70192->70193 70194 7ff660ad9810 70193->70194 70195 7ff660a93c10 shared_ptr 47 API calls 70194->70195 70196 7ff660ad9855 70195->70196 70197 7ff660a93c10 shared_ptr 47 API calls 70196->70197 70198 7ff660ad9863 70197->70198 70199 7ff660a93c10 shared_ptr 47 API calls 70198->70199 70200 7ff660ad9871 70199->70200 70201 7ff660ad7fa0 47 API calls 70200->70201 70202 7ff660ad987c 70201->70202 70203 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70202->70203 70203->70204 70205 7ff660b1f8f0 70204->70205 70507 7ff660b1ff10 70205->70507 70208 7ff660c5caf0 70209 7ff660c5cb23 70208->70209 70210 7ff660c5cb54 70209->70210 70211 7ff660c5cb2e 70209->70211 70543 7ff660ade140 51 API calls 70210->70543 70542 7ff660c55250 51 API calls 70211->70542 70214 7ff660c5cb66 CoTaskMemFree 70216 7ff660c5cb80 70214->70216 70215 7ff660c5cb42 70218 7ff660b188f0 70215->70218 70217 7ff660ab9140 shared_ptr 47 API calls 70216->70217 70217->70215 70222 7ff660b18920 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= std::_Is_slash_oper::operator 70218->70222 70219 7ff660b18afb 70545 7ff660ab7620 70219->70545 70222->70219 70227 7ff660b18992 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= std::_Is_slash_oper::operator 70222->70227 70544 7ff660b17ee0 51 API calls 2 library calls 70227->70544 70229 7ff660b18ac9 70230 7ff660ab9140 shared_ptr 47 API calls 70229->70230 70414 7ff660ac5230 70403->70414 70405 7ff660accaf3 70421 7ff660acab10 70405->70421 70407 7ff660accb0b 70408 7ff660a93c10 shared_ptr 47 API calls 70407->70408 70409 7ff660accb32 70408->70409 70425 7ff660ac58f0 70409->70425 70411 7ff660accb3d 70411->70155 70412->70164 70413->70164 70430 7ff660a93410 70414->70430 70416 7ff660ac5259 70433 7ff660ca2bd0 70416->70433 70420 7ff660ac52bc 70420->70405 70422 7ff660acab35 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 70421->70422 70462 7ff660acab80 70422->70462 70426 7ff660a93c10 shared_ptr 47 API calls 70425->70426 70427 7ff660ac5919 70426->70427 70428 7ff660a93be0 std::ios_base::failure::failure 47 API calls 70427->70428 70429 7ff660ac592a type_info::_name_internal_method 70428->70429 70429->70411 70443 7ff660c81e9c 70430->70443 70435 7ff660ca2bdb 70433->70435 70434 7ff660ac52a3 70434->70420 70442 7ff660ac4f30 58 API calls std::bad_exception::bad_exception 70434->70442 70435->70434 70436 7ff660cbfffc std::_Facet_Register 2 API calls 70435->70436 70437 7ff660ca2bfa 70435->70437 70436->70435 70440 7ff660ca2c05 70437->70440 70456 7ff660c81810 70437->70456 70460 7ff660ca3960 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error Concurrency::cancel_current_task 70440->70460 70441 7ff660ca2c0b 70442->70420 70444 7ff660c813e8 std::_Lockit::_Lockit 6 API calls 70443->70444 70445 7ff660c81ebe 70444->70445 70453 7ff660c81f02 memcpy_s 70445->70453 70454 7ff660c820c8 4 API calls 2 library calls 70445->70454 70447 7ff660c81460 std::_Lockit::~_Lockit LeaveCriticalSection 70449 7ff660a93420 70447->70449 70448 7ff660c81ed6 70455 7ff660c820f8 48 API calls std::locale::_Setgloballocale 70448->70455 70449->70416 70451 7ff660c81ee1 70452 7ff660ca9ad0 __std_exception_destroy 13 API calls 70451->70452 70451->70453 70452->70453 70453->70447 70454->70448 70455->70451 70457 7ff660c8181e std::bad_alloc::bad_alloc 70456->70457 70461 7ff660ca3da0 RtlPcToFileHeader RaiseException 70457->70461 70459 7ff660c8182f 70460->70441 70461->70459 70463 7ff660acabae 70462->70463 70464 7ff660aa2e10 51 API calls 70463->70464 70468 7ff660acac11 Concurrency::details::HardwareAffinity::operator!= 70464->70468 70465 7ff660a93c10 shared_ptr 47 API calls 70466 7ff660acaed8 70465->70466 70467 7ff660a93c10 shared_ptr 47 API calls 70466->70467 70469 7ff660acab66 70467->70469 70470 7ff660acad28 70468->70470 70475 7ff660acad5c 70468->70475 70478 7ff660acad18 70468->70478 70469->70407 70471 7ff660acad62 Concurrency::details::HardwareAffinity::operator!= 70470->70471 70472 7ff660acad34 70470->70472 70476 7ff660acad72 70471->70476 70477 7ff660acad87 70471->70477 70474 7ff660aa2d10 type_info::_name_internal_method 51 API calls 70472->70474 70473 7ff660acad23 70473->70475 70479 7ff660acae4e 70473->70479 70480 7ff660acae99 70473->70480 70474->70475 70475->70465 70481 7ff660aa2e10 51 API calls 70476->70481 70483 7ff660acade5 70477->70483 70484 7ff660acad97 70477->70484 70478->70473 70498 7ff660acb9d0 51 API calls 2 library calls 70478->70498 70485 7ff660a910b0 51 API calls 70479->70485 70499 7ff660ac7f30 51 API calls 2 library calls 70480->70499 70481->70475 70497 7ff660ac7f30 51 API calls 2 library calls 70483->70497 70487 7ff660a910b0 51 API calls 70484->70487 70489 7ff660acae6a 70485->70489 70491 7ff660acadb3 70487->70491 70490 7ff660a93c10 shared_ptr 47 API calls 70489->70490 70492 7ff660acae82 70490->70492 70493 7ff660a93c10 shared_ptr 47 API calls 70491->70493 70494 7ff660a93c10 shared_ptr 47 API calls 70492->70494 70495 7ff660acadcb 70493->70495 70494->70469 70496 7ff660a93c10 shared_ptr 47 API calls 70495->70496 70496->70469 70497->70475 70498->70478 70499->70475 70501 7ff660a8b787 std::_Throw_Cpp_error 70500->70501 70504 7ff660a8b796 Concurrency::details::WorkQueue::IsStructuredEmpty std::_Throw_Cpp_error 70501->70504 70506 7ff660aa2970 51 API calls std::_Throw_Cpp_error 70501->70506 70503 7ff660a8b7d2 std::_Throw_Cpp_error SafeRWList shared_ptr 70503->70179 70504->70503 70505 7ff660a8af90 std::_Throw_Cpp_error 49 API calls 70504->70505 70505->70503 70506->70504 70508 7ff660b1ff3c 70507->70508 70511 7ff660b17cb0 70508->70511 70516 7ff660c87358 70511->70516 70517 7ff660cbab18 _Getctype 47 API calls 70516->70517 70518 7ff660c87361 70517->70518 70519 7ff660c8736a AreFileApisANSI 70518->70519 70520 7ff660b17ce6 70518->70520 70519->70520 70521 7ff660b19a70 70520->70521 70525 7ff660b19a97 allocator List 70521->70525 70522 7ff660b19ba8 70523 7ff660a93c10 shared_ptr 47 API calls 70522->70523 70524 7ff660b17d14 70523->70524 70524->70208 70525->70522 70527 7ff660b19ad6 operator== allocator 70525->70527 70537 7ff660b04c30 51 API calls 2 library calls 70525->70537 70538 7ff660c87380 MultiByteToWideChar GetLastError 70527->70538 70529 7ff660b19b1b 70539 7ff660aff420 51 API calls 70529->70539 70531 7ff660b19b2a 70532 7ff660aac710 51 API calls 70531->70532 70533 7ff660b19b43 operator== Concurrency::details::WorkQueue::IsStructuredEmpty allocator 70532->70533 70540 7ff660c87380 MultiByteToWideChar GetLastError 70533->70540 70535 7ff660b19b99 70541 7ff660aff420 51 API calls 70535->70541 70537->70527 70538->70529 70539->70531 70540->70535 70541->70522 70542->70215 70543->70214 70544->70229 70546 7ff660a910b0 51 API calls 70545->70546 70547 7ff660ab764a 70546->70547 71120->70003 71121->70032 71122->70106 71123->70095 71124->70099 71125->70101 71126->70113 71127->70115 71129 7ff660a916d0 71130 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 71129->71130 71131 7ff660a91718 71130->71131 71132 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 71131->71132 71133 7ff660a91742 71132->71133 71134 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 71133->71134 71135 7ff660a9176c 71134->71135 71136 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 71135->71136 71137 7ff660a917a8 71136->71137 71138 7ff660a911a0 _Mpunct 51 API calls 71137->71138 71139 7ff660a91942 71138->71139 71140 7ff660a905d0 59 API calls 71139->71140 71141 7ff660a91970 71140->71141 71266 7ff660c3e070 71141->71266 71143 7ff660a9199c 71274 7ff660ac1780 71143->71274 71145 7ff660a919ca 71280 7ff660b2f5c0 71145->71280 71149 7ff660a919f7 71290 7ff660c54db0 71149->71290 71151 7ff660a91a4a 71152 7ff660a911a0 _Mpunct 51 API calls 71151->71152 71153 7ff660a91b83 71152->71153 71154 7ff660ad98a0 70 API calls 71153->71154 71155 7ff660a91ba0 operator== 71154->71155 71156 7ff660a911a0 _Mpunct 51 API calls 71155->71156 71157 7ff660a91bd5 UnDecorator::getVbTableType 71156->71157 71158 7ff660a910b0 51 API calls 71157->71158 71159 7ff660a91c09 operator== 71158->71159 71160 7ff660a91c3b CreateEventW 71159->71160 71161 7ff660a91c67 UnDecorator::getVbTableType 71160->71161 71293 7ff660a997a0 GetDesktopWindow EnumChildWindows 71161->71293 71163 7ff660a91c75 71164 7ff660ca2bd0 std::_Facet_Register 4 API calls 71163->71164 71165 7ff660a91c80 71164->71165 71166 7ff660a91c9f 71165->71166 71415 7ff660b2c0b0 73 API calls 4 library calls 71165->71415 71168 7ff660ca2bd0 std::_Facet_Register 4 API calls 71166->71168 71169 7ff660a91cda 71168->71169 71170 7ff660a91cf3 71169->71170 71416 7ff660b340f0 49 API calls 71169->71416 71294 7ff660b2e000 71170->71294 71174 7ff660ca2bd0 std::_Facet_Register 4 API calls 71175 7ff660a91d43 71174->71175 71177 7ff660a91d62 71175->71177 71301 7ff660b30320 71175->71301 71304 7ff660c53e60 71177->71304 71267 7ff660c3e0a5 71266->71267 71268 7ff660c3e0db CoInitializeEx 71267->71268 71269 7ff660c3e0f3 71268->71269 71270 7ff660c3e0f1 71268->71270 71432 7ff660af9be0 CoCreateInstance 71269->71432 71270->71143 71272 7ff660c3e11b 71272->71270 71433 7ff660c3e460 71272->71433 71275 7ff660ac17b3 71274->71275 71276 7ff660a90510 66 API calls 71275->71276 71277 7ff660ac17c5 71276->71277 71518 7ff660ac1a20 71277->71518 71279 7ff660ac17d7 UnDecorator::getVbTableType 71279->71145 71527 7ff660c6af60 71280->71527 71282 7ff660b2f5d6 71532 7ff660b2f480 71282->71532 71285 7ff660b39690 71560 7ff660ac5030 71285->71560 71288 7ff660ac5030 49 API calls 71289 7ff660b396b8 71288->71289 71289->71149 71291 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 71290->71291 71292 7ff660c54ddc 71291->71292 71292->71151 71293->71163 71584 7ff660b2ad20 71294->71584 71298 7ff660b2e04e 71592 7ff660a94e10 71298->71592 71638 7ff660b317f0 71301->71638 71305 7ff660c53e6e 71304->71305 71308 7ff660a91da4 71304->71308 71306 7ff660ca2bd0 std::_Facet_Register 4 API calls 71305->71306 71307 7ff660c53e78 71306->71307 71307->71308 71651 7ff660c531f0 50 API calls 71307->71651 71310 7ff660aa4410 71308->71310 71311 7ff660c53e60 50 API calls 71310->71311 71312 7ff660aa4421 Concurrency::details::_Scheduler::_Scheduler 71311->71312 71313 7ff660a90510 66 API calls 71312->71313 71314 7ff660aa447f 71313->71314 71652 7ff660c53f40 71314->71652 71316 7ff660aa44a9 Concurrency::details::_Scheduler::_Scheduler UnDecorator::getVbTableType 71317 7ff660a90510 66 API calls 71316->71317 71318 7ff660aa4517 71317->71318 71319 7ff660c53f40 55 API calls 71318->71319 71320 7ff660aa4547 UnDecorator::getVbTableType 71319->71320 71673 7ff660c542a0 71320->71673 71415->71166 71416->71170 71432->71272 71434 7ff660a911a0 _Mpunct 51 API calls 71433->71434 71435 7ff660c3e49d 71434->71435 71436 7ff660ad98a0 70 API calls 71435->71436 71437 7ff660c3e4b7 71436->71437 71438 7ff660a911a0 _Mpunct 51 API calls 71437->71438 71439 7ff660c3e4dc 71438->71439 71440 7ff660ad98a0 70 API calls 71439->71440 71442 7ff660c3e4f6 operator== SafeRWList Concurrency::details::HardwareAffinity::operator!= 71440->71442 71441 7ff660c3e5e9 UnDecorator::getVbTableType 71441->71270 71442->71441 71475 7ff660c392b0 71442->71475 71444 7ff660c3e7ca operator== SafeRWList 71445 7ff660c392b0 3 API calls 71444->71445 71450 7ff660c3e830 operator== SafeRWList 71445->71450 71446 7ff660c3ebfd 71494 7ff660af7300 #6 71446->71494 71448 7ff660c3ec07 71495 7ff660af7300 #6 71448->71495 71450->71446 71451 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 71450->71451 71452 7ff660c3e8f6 71451->71452 71453 7ff660ad8e90 70 API calls 71452->71453 71454 7ff660c3e913 operator== 71453->71454 71455 7ff660c3e950 #7 71454->71455 71456 7ff660c3e96a operator== 71455->71456 71483 7ff660ac49e0 71456->71483 71461 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 71462 7ff660c3ea04 71461->71462 71463 7ff660ad8e90 70 API calls 71462->71463 71464 7ff660c3ea21 operator== 71463->71464 71466 7ff660c3ea5e #7 71464->71466 71465 7ff660c3eb7c 71492 7ff660af7300 #6 71465->71492 71467 7ff660c3ea78 operator== 71466->71467 71469 7ff660ac49e0 59 API calls 71467->71469 71471 7ff660c3ea9d 71469->71471 71470 7ff660c3eba3 71493 7ff660af7300 #6 71470->71493 71473 7ff660b26bb0 allocator 2 API calls 71471->71473 71474 7ff660c3ead5 UnDecorator::getVbTableType 71473->71474 71474->71446 71474->71465 71476 7ff660c392c4 71475->71476 71480 7ff660c392ce 71475->71480 71496 7ff660a98370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 71476->71496 71478 7ff660c392d6 71478->71444 71479 7ff660c392e4 #4 71481 7ff660c39302 List 71479->71481 71480->71478 71480->71479 71481->71478 71497 7ff660a98370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 71481->71497 71484 7ff660a9a5a0 57 API calls 71483->71484 71485 7ff660ac49f8 71484->71485 71498 7ff660ac4880 71485->71498 71488 7ff660b26bb0 71489 7ff660b26bc8 operator== 71488->71489 71513 7ff660a98560 71489->71513 71491 7ff660b26bd5 71491->71461 71491->71474 71492->71470 71493->71441 71494->71448 71495->71441 71496->71480 71497->71478 71499 7ff660ac4898 71498->71499 71499->71499 71501 7ff660ac48d8 71499->71501 71510 7ff660a98370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 71499->71510 71503 7ff660ac48f1 71501->71503 71511 7ff660a98370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 71501->71511 71504 7ff660ac4927 UnDecorator::getVbTableType 71503->71504 71512 7ff660a9ea20 RtlPcToFileHeader RaiseException strrchr 71503->71512 71506 7ff660a9c0d0 UnDecorator::getVbTableType 2 API calls 71504->71506 71507 7ff660ac4945 71506->71507 71508 7ff660ab0d40 UnDecorator::getVbTableType 47 API calls 71507->71508 71509 7ff660ac496d 71508->71509 71509->71488 71510->71499 71511->71503 71512->71504 71514 7ff660a9856e allocator 71513->71514 71516 7ff660a985b9 operator== type_info::_name_internal_method 71514->71516 71517 7ff660a98370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 71514->71517 71516->71491 71517->71514 71519 7ff660ac1a38 71518->71519 71523 7ff660ac1a6a 71518->71523 71520 7ff660ca2bd0 std::_Facet_Register 4 API calls 71519->71520 71521 7ff660ac1a42 71520->71521 71522 7ff660ac1a4f 71521->71522 71521->71523 71526 7ff660b409e0 75 API calls 6 library calls 71522->71526 71523->71279 71525 7ff660ac1a63 71525->71523 71526->71525 71536 7ff660c5bef0 71527->71536 71529 7ff660c6af9e memcpy_s 71530 7ff660c6b002 WlanAllocateMemory 71529->71530 71531 7ff660c6b02b memcpy_s 71530->71531 71531->71282 71533 7ff660b2f496 71532->71533 71534 7ff660b2f4db CoInitializeEx CoInitializeSecurity CoCreateInstance IcmpCreateFile 71533->71534 71535 7ff660a919e0 71534->71535 71535->71285 71539 7ff660c5bb40 71536->71539 71540 7ff660c5bb71 71539->71540 71543 7ff660c5d9a0 71540->71543 71542 7ff660c5bb7c 71542->71529 71544 7ff660c5d9b3 Concurrency::details::WorkQueue::IsStructuredEmpty std::_Throw_Cpp_error 71543->71544 71547 7ff660c56250 71544->71547 71546 7ff660c5d9ea shared_ptr 71546->71542 71550 7ff660c5f010 71547->71550 71549 7ff660c56268 std::_Throw_Cpp_error 71549->71546 71555 7ff660c58170 71550->71555 71553 7ff660a8aef0 allocator 49 API calls 71554 7ff660c5f030 71553->71554 71554->71549 71556 7ff660c581a3 71555->71556 71557 7ff660c5819e 71555->71557 71556->71553 71559 7ff660aa2260 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error Concurrency::cancel_current_task 71557->71559 71559->71556 71563 7ff660ac4a20 71560->71563 71564 7ff660ac4a51 71563->71564 71567 7ff660ac6da0 71564->71567 71566 7ff660ac4a5c 71566->71288 71568 7ff660ac6db3 Concurrency::details::WorkQueue::IsStructuredEmpty std::_Throw_Cpp_error 71567->71568 71571 7ff660ac27d0 71568->71571 71570 7ff660ac6dea shared_ptr 71570->71566 71574 7ff660ac80e0 71571->71574 71573 7ff660ac27e8 std::_Throw_Cpp_error 71573->71570 71579 7ff660ac37a0 71574->71579 71577 7ff660a8aef0 allocator 49 API calls 71578 7ff660ac8100 71577->71578 71578->71573 71580 7ff660ac37ce 71579->71580 71581 7ff660ac37d3 71579->71581 71583 7ff660aa2260 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error Concurrency::cancel_current_task 71580->71583 71581->71577 71583->71581 71585 7ff660b2ad3d SafeRWList 71584->71585 71596 7ff660b2b530 71585->71596 71587 7ff660b2ad65 71588 7ff660b2cd80 71587->71588 71589 7ff660b2cd9a 71588->71589 71590 7ff660b2cda6 71589->71590 71636 7ff660cafd20 47 API calls 2 library calls 71589->71636 71590->71298 71593 7ff660a94e23 71592->71593 71595 7ff660a91d38 71593->71595 71637 7ff660cafd20 47 API calls 2 library calls 71593->71637 71595->71174 71597 7ff660b2b550 SafeRWList 71596->71597 71604 7ff660a8fc90 71597->71604 71599 7ff660b2b578 operator== 71607 7ff660cafc38 71599->71607 71603 7ff660b2b5d3 type_info::_name_internal_method 71603->71587 71605 7ff660ca2bd0 std::_Facet_Register 4 API calls 71604->71605 71606 7ff660a8fcb5 SafeRWList type_info::_name_internal_method 71605->71606 71606->71599 71608 7ff660cafc6f 71607->71608 71609 7ff660cafc58 71607->71609 71626 7ff660cafb0c 71608->71626 71633 7ff660ca90f0 11 API calls _get_daylight 71609->71633 71612 7ff660cafc5d 71634 7ff660ca8f84 47 API calls _invalid_parameter_noinfo_noreturn 71612->71634 71615 7ff660cafc82 CreateThread 71616 7ff660b2b5c0 71615->71616 71617 7ff660cafcb2 GetLastError 71615->71617 71616->71603 71625 7ff660c81c68 51 API calls 3 library calls 71616->71625 71635 7ff660ca9064 11 API calls 2 library calls 71617->71635 71619 7ff660cafcbf 71620 7ff660cafcce 71619->71620 71621 7ff660cafcc8 CloseHandle 71619->71621 71622 7ff660cafcd7 FreeLibrary 71620->71622 71623 7ff660cafcdd 71620->71623 71621->71620 71622->71623 71624 7ff660cc0dd4 __free_lconv_mon 11 API calls 71623->71624 71624->71616 71627 7ff660cc0d5c _get_daylight 11 API calls 71626->71627 71628 7ff660cafb2e 71627->71628 71629 7ff660cc0dd4 __free_lconv_mon 11 API calls 71628->71629 71630 7ff660cafb38 71629->71630 71631 7ff660cafb41 GetModuleHandleExW 71630->71631 71632 7ff660cafb3d 71630->71632 71631->71632 71632->71615 71632->71616 71633->71612 71634->71616 71635->71619 71645 7ff660b31860 6 API calls 71638->71645 71640 7ff660b31808 71641 7ff660b31860 9 API calls 71640->71641 71642 7ff660b31820 71641->71642 71643 7ff660b31860 9 API calls 71642->71643 71644 7ff660b30421 71643->71644 71644->71177 71649 7ff660cd3ad0 71645->71649 71648 7ff660b31940 71648->71640 71650 7ff660b31908 GlobalUnlock CreateStreamOnHGlobal GetLastError 71649->71650 71650->71648 71651->71308 71654 7ff660c53f7f 71652->71654 71653 7ff660c54281 71653->71316 71654->71653 71655 7ff660c53fb7 71654->71655 71656 7ff660c54109 71654->71656 71657 7ff660ca2bd0 std::_Facet_Register 4 API calls 71655->71657 71658 7ff660ca2bd0 std::_Facet_Register 4 API calls 71656->71658 71660 7ff660c53fd7 71657->71660 71661 7ff660c54129 71658->71661 71659 7ff660c541a9 71683 7ff660b11f20 51 API calls SafeRWList 71659->71683 71665 7ff660c54045 71660->71665 71679 7ff660c53170 49 API calls Concurrency::details::SchedulerBase::GetPolicy 71660->71679 71661->71659 71682 7ff660c53170 49 API calls Concurrency::details::SchedulerBase::GetPolicy 71661->71682 71680 7ff660c549a0 51 API calls SafeRWList 71665->71680 71666 7ff660c541eb operator== 71667 7ff660c541f9 AppendMenuW 71666->71667 71669 7ff660c54103 71667->71669 71670 7ff660c540f5 71681 7ff660c54340 3 API calls 6 library calls 71670->71681 71674 7ff660c542c6 71673->71674 71679->71665 71680->71670 71681->71669 71682->71659 71683->71666 72263 7ff660a9c290 72264 7ff660a9c2a8 ctype 72263->72264 72590 7ff660aaa0d0 72264->72590 72266 7ff660a9c2b8 72267 7ff660aad500 74 API calls 72266->72267 72268 7ff660a9c2ca 72267->72268 72269 7ff660a911a0 _Mpunct 51 API calls 72268->72269 72270 7ff660a9c2ef 72269->72270 72271 7ff660ad98a0 70 API calls 72270->72271 72272 7ff660a9c309 72271->72272 72273 7ff660a911a0 _Mpunct 51 API calls 72272->72273 72274 7ff660a9c32e 72273->72274 72275 7ff660ad98a0 70 API calls 72274->72275 72276 7ff660a9c348 72275->72276 72277 7ff660a911a0 _Mpunct 51 API calls 72276->72277 72278 7ff660a9c36d 72277->72278 72279 7ff660ad98a0 70 API calls 72278->72279 72280 7ff660a9c387 72279->72280 72281 7ff660a911a0 _Mpunct 51 API calls 72280->72281 72282 7ff660a9c3ac 72281->72282 72283 7ff660ad98a0 70 API calls 72282->72283 72284 7ff660a9c3c6 72283->72284 72285 7ff660a911a0 _Mpunct 51 API calls 72284->72285 72286 7ff660a9c3eb 72285->72286 72287 7ff660ad98a0 70 API calls 72286->72287 72288 7ff660a9c405 72287->72288 72289 7ff660a911a0 _Mpunct 51 API calls 72288->72289 72290 7ff660a9c42a 72289->72290 72291 7ff660ad98a0 70 API calls 72290->72291 72292 7ff660a9c447 operator== 72291->72292 72293 7ff660a911a0 _Mpunct 51 API calls 72292->72293 72294 7ff660a9c47c UnDecorator::getVbTableType 72293->72294 72295 7ff660a911a0 _Mpunct 51 API calls 72294->72295 72296 7ff660a9c4af 72295->72296 72297 7ff660ad98a0 70 API calls 72296->72297 72298 7ff660a9c4c9 72297->72298 72299 7ff660a905d0 59 API calls 72298->72299 72300 7ff660a9c4d4 72299->72300 72667 7ff660afa6b0 72300->72667 72302 7ff660a9c4e2 operator== 72303 7ff660a9a250 68 API calls 72302->72303 72304 7ff660a9c54c UnDecorator::getVbTableType 72303->72304 72305 7ff660a90510 66 API calls 72304->72305 72306 7ff660a9c56f 72305->72306 72307 7ff660a90510 66 API calls 72306->72307 72308 7ff660a9c584 72307->72308 72309 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 72308->72309 72310 7ff660a9c5a7 72309->72310 72311 7ff660ad8e90 70 API calls 72310->72311 72312 7ff660a9c5c4 72311->72312 72313 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 72312->72313 72314 7ff660a9c60e 72313->72314 72315 7ff660ad8e90 70 API calls 72314->72315 72316 7ff660a9c62b 72315->72316 72317 7ff660b1ca30 75 API calls 72316->72317 72318 7ff660a9c682 UnDecorator::getVbTableType 72317->72318 72683 7ff660a88ad0 72318->72683 72591 7ff660aa62c0 73 API calls 72590->72591 72592 7ff660aaa0e9 72591->72592 72593 7ff660aaa6b2 UnDecorator::getVbTableType 72592->72593 72594 7ff660a911a0 _Mpunct 51 API calls 72592->72594 72593->72266 72595 7ff660aaa11c 72594->72595 72596 7ff660ad98a0 70 API calls 72595->72596 72597 7ff660aaa136 72596->72597 72598 7ff660a911a0 _Mpunct 51 API calls 72597->72598 72599 7ff660aaa15b 72598->72599 72600 7ff660ad98a0 70 API calls 72599->72600 72601 7ff660aaa175 72600->72601 72602 7ff660a905d0 59 API calls 72601->72602 72603 7ff660aaa180 72602->72603 72604 7ff660a905d0 59 API calls 72603->72604 72605 7ff660aaa18b 72604->72605 72606 7ff660aaa1ab 72605->72606 72607 7ff660aaa19b 72605->72607 72610 7ff660a911a0 _Mpunct 51 API calls 72606->72610 72608 7ff660aaa1a6 72607->72608 72609 7ff660aaa22a 72607->72609 72613 7ff660a905d0 59 API calls 72608->72613 72612 7ff660a911a0 _Mpunct 51 API calls 72609->72612 72611 7ff660aaa1cf 72610->72611 72614 7ff660ad98a0 70 API calls 72611->72614 72615 7ff660aaa24e 72612->72615 72616 7ff660aaa2b3 72613->72616 72617 7ff660aaa1ec 72614->72617 72618 7ff660ad98a0 70 API calls 72615->72618 72619 7ff660a911a0 _Mpunct 51 API calls 72616->72619 72620 7ff660a94f50 UnDecorator::getVbTableType 49 API calls 72617->72620 72621 7ff660aaa26b 72618->72621 72622 7ff660aaa2d8 72619->72622 72654 7ff660aaa216 UnDecorator::getVbTableType 72620->72654 72623 7ff660a94f50 UnDecorator::getVbTableType 49 API calls 72621->72623 72624 7ff660ad98a0 70 API calls 72622->72624 72623->72654 72625 7ff660aaa2f5 72624->72625 72626 7ff660a94f50 UnDecorator::getVbTableType 49 API calls 72625->72626 72628 7ff660aaa31f UnDecorator::getVbTableType 72626->72628 72627 7ff660a911a0 _Mpunct 51 API calls 72629 7ff660aaa46f 72627->72629 72632 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 72628->72632 72630 7ff660ad98a0 70 API calls 72629->72630 72631 7ff660aaa489 72630->72631 72633 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 72631->72633 72634 7ff660aaa350 72632->72634 72636 7ff660aaa4ac 72633->72636 72635 7ff660ad8e90 70 API calls 72634->72635 72637 7ff660aaa36d operator== 72635->72637 72638 7ff660ad8e90 70 API calls 72636->72638 72642 7ff660a9a250 68 API calls 72637->72642 72639 7ff660aaa4c9 72638->72639 72640 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 72639->72640 72641 7ff660aaa516 72640->72641 72643 7ff660ad8e90 70 API calls 72641->72643 72645 7ff660aaa3a4 operator== UnDecorator::getVbTableType 72642->72645 72644 7ff660aaa533 operator== 72643->72644 72646 7ff660a9a250 68 API calls 72644->72646 72647 7ff660a911a0 _Mpunct 51 API calls 72645->72647 72650 7ff660aaa57a UnDecorator::getVbTableType 72646->72650 72648 7ff660aaa3dd 72647->72648 72649 7ff660ad98a0 70 API calls 72648->72649 72651 7ff660aaa3fa 72649->72651 72653 7ff660a90510 66 API calls 72650->72653 72652 7ff660a94f50 UnDecorator::getVbTableType 49 API calls 72651->72652 72652->72654 72655 7ff660aaa5a8 72653->72655 72654->72627 72656 7ff660a90510 66 API calls 72655->72656 72657 7ff660aaa5ba 72656->72657 72658 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 72657->72658 72659 7ff660aaa5dd 72658->72659 72660 7ff660ad8e90 70 API calls 72659->72660 72661 7ff660aaa5fa 72660->72661 72662 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 72661->72662 72663 7ff660aaa644 72662->72663 72664 7ff660ad8e90 70 API calls 72663->72664 72665 7ff660aaa661 72664->72665 72666 7ff660b1ca30 75 API calls 72665->72666 72666->72593 72668 7ff660a905d0 59 API calls 72667->72668 72669 7ff660afa6ce 72668->72669 73480 7ff660a9a530 72669->73480 72672 7ff660afa70b 72675 7ff660a911a0 _Mpunct 51 API calls 72672->72675 72673 7ff660afa796 72674 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 72673->72674 72682 7ff660afa76b UnDecorator::getVbTableType 72674->72682 72676 7ff660afa726 72675->72676 72677 7ff660ad98a0 70 API calls 72676->72677 72678 7ff660afa73a 72677->72678 72679 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 72678->72679 72680 7ff660afa754 72679->72680 72681 7ff660ad8e90 70 API calls 72680->72681 72681->72682 72682->72302 72684 7ff660a88aed SafeRWList 72683->72684 73485 7ff660a8ec10 72684->73485 72686 7ff660a88b15 72687 7ff660aa48d0 72686->72687 72688 7ff660aa48e5 72687->72688 72689 7ff660aa48f6 72688->72689 73495 7ff660c81c68 51 API calls 3 library calls 72688->73495 73494 7ff660c819c0 CloseHandle 72689->73494 72692 7ff660aa4915 72693 7ff660a9c705 72692->72693 73496 7ff660c81c68 51 API calls 3 library calls 72692->73496 72695 7ff660a98790 72693->72695 72696 7ff660a911a0 _Mpunct 51 API calls 72695->72696 72697 7ff660a987c0 72696->72697 72698 7ff660ad98a0 70 API calls 72697->72698 72699 7ff660a987dd operator== 72698->72699 72700 7ff660a911a0 _Mpunct 51 API calls 72699->72700 72701 7ff660a98812 UnDecorator::getVbTableType 72700->72701 72702 7ff660a911a0 _Mpunct 51 API calls 72701->72702 72703 7ff660a98845 72702->72703 72704 7ff660ad98a0 70 API calls 72703->72704 72705 7ff660a98862 operator== 72704->72705 72706 7ff660a911a0 _Mpunct 51 API calls 72705->72706 72707 7ff660a98897 UnDecorator::getVbTableType 72706->72707 72708 7ff660a911a0 _Mpunct 51 API calls 72707->72708 72709 7ff660a988ca 72708->72709 72710 7ff660ad98a0 70 API calls 72709->72710 72711 7ff660a988e7 operator== 72710->72711 72712 7ff660a911a0 _Mpunct 51 API calls 72711->72712 72713 7ff660a9891c UnDecorator::getVbTableType 72712->72713 72714 7ff660a911a0 _Mpunct 51 API calls 72713->72714 72715 7ff660a9894f 72714->72715 72716 7ff660ad98a0 70 API calls 72715->72716 72717 7ff660a9896c operator== 72716->72717 72718 7ff660a911a0 _Mpunct 51 API calls 72717->72718 72719 7ff660a989a1 UnDecorator::getVbTableType 72718->72719 72720 7ff660a905d0 59 API calls 72719->72720 72721 7ff660a989ba 72720->72721 72722 7ff660b3b750 98 API calls 72721->72722 72723 7ff660a989c0 72722->72723 72724 7ff660a989c9 72723->72724 72725 7ff660a98bdb 72723->72725 72727 7ff660a911a0 _Mpunct 51 API calls 72724->72727 73497 7ff660b0e480 GetModuleFileNameW 72725->73497 72729 7ff660a989ed 72727->72729 72732 7ff660ad98a0 70 API calls 72729->72732 72730 7ff660a98e18 72733 7ff660a911a0 _Mpunct 51 API calls 72730->72733 72731 7ff660a98beb 72734 7ff660a911a0 _Mpunct 51 API calls 72731->72734 72735 7ff660a98a0a 72732->72735 72736 7ff660a98e3c 72733->72736 72737 7ff660a98c0f 72734->72737 72738 7ff660a90510 66 API calls 72735->72738 72740 7ff660ad98a0 70 API calls 72736->72740 72741 7ff660ad98a0 70 API calls 72737->72741 72739 7ff660a98a1c 72738->72739 72742 7ff660a90510 66 API calls 72739->72742 72743 7ff660a98e56 72740->72743 72744 7ff660a98c2c 72741->72744 72745 7ff660a98a2e 72742->72745 72746 7ff660a911a0 _Mpunct 51 API calls 72743->72746 72747 7ff660a90510 66 API calls 72744->72747 72748 7ff660a90510 66 API calls 72745->72748 72749 7ff660a98e7b 72746->72749 72750 7ff660a98c41 72747->72750 72751 7ff660a98a40 72748->72751 72752 7ff660ad98a0 70 API calls 72749->72752 72753 7ff660a90510 66 API calls 72750->72753 72755 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 72751->72755 72756 7ff660a98e95 memcpy_s 72752->72756 72754 7ff660a98c56 72753->72754 72757 7ff660a90510 66 API calls 72754->72757 72758 7ff660a98a66 72755->72758 72763 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 72756->72763 72759 7ff660a98c6b 72757->72759 72760 7ff660ad8e90 70 API calls 72758->72760 72761 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 72759->72761 72762 7ff660a98a83 72760->72762 72765 7ff660a910b0 51 API calls 72762->72765 72766 7ff660a98ed5 72763->72766 72769 7ff660a98ad0 72765->72769 72767 7ff660ad8e90 70 API calls 72766->72767 73511 7ff660b1d350 88 API calls 5 library calls 72769->73511 72784 7ff660a98b3e UnDecorator::getVbTableType 72790 7ff660a93c10 shared_ptr 47 API calls 72784->72790 72793 7ff660a98ba7 72790->72793 72795 7ff660a93c10 shared_ptr 47 API calls 72793->72795 73481 7ff660a9a543 strrchr std::ios_base::good 73480->73481 73482 7ff660a9a56b GetUserDefaultUILanguage LCIDToLocaleName 73481->73482 73484 7ff660a9a140 49 API calls 2 library calls 73481->73484 73482->72672 73482->72673 73484->73482 73486 7ff660a8ec30 SafeRWList 73485->73486 73487 7ff660a8fc90 4 API calls 73486->73487 73488 7ff660a8ec58 operator== 73487->73488 73489 7ff660cafc38 52 API calls 73488->73489 73490 7ff660a8eca0 73489->73490 73492 7ff660a8ecb3 type_info::_name_internal_method 73490->73492 73493 7ff660c81c68 51 API calls 3 library calls 73490->73493 73492->72686 73494->72692 73498 7ff660b0e49e 73497->73498 73516 7ff660cb611c 73498->73516 73511->72784 73517 7ff660cb6171 SetCurrentDirectoryW 73516->73517 73518 7ff660cb6152 73516->73518 73520 7ff660cb618a 73517->73520 73521 7ff660cb617b GetLastError 73517->73521 73541 7ff660ca90d0 11 API calls _get_daylight 73518->73541 73545 7ff660cb6058 15 API calls 4 library calls 73520->73545 73544 7ff660ca9064 11 API calls 2 library calls 73521->73544 73523 7ff660cb6157 73542 7ff660ca90f0 11 API calls _get_daylight 73523->73542 73525 7ff660cb6169 73533 7ff660ca31a0 std::_Throw_Cpp_error 8 API calls 73525->73533 73526 7ff660cb61c6 73528 7ff660cb61dd 73526->73528 73529 7ff660cb61ca 73526->73529 73534 7ff660cb61f7 73528->73534 73546 7ff660cb9538 56 API calls 73528->73546 73529->73525 73532 7ff660cc0dd4 __free_lconv_mon 11 API calls 73529->73532 73530 7ff660cb615e 73543 7ff660ca8f84 47 API calls _invalid_parameter_noinfo_noreturn 73530->73543 73532->73525 73535 7ff660a98be0 73533->73535 73534->73525 73538 7ff660cc0dd4 __free_lconv_mon 11 API calls 73534->73538 73535->72730 73535->72731 73537 7ff660cb6203 SetEnvironmentVariableW 73537->73534 73539 7ff660cb622c GetLastError 73537->73539 73538->73525 73547 7ff660ca9064 11 API calls 2 library calls 73539->73547 73541->73523 73542->73530 73543->73525 73544->73525 73545->73526 73546->73537 73547->73534 75095 7ff660a997d0 75096 7ff660a911a0 _Mpunct 51 API calls 75095->75096 75097 7ff660a9980e 75096->75097 75098 7ff660ad98a0 70 API calls 75097->75098 75099 7ff660a99825 operator== 75098->75099 75100 7ff660a911a0 _Mpunct 51 API calls 75099->75100 75101 7ff660a9985a UnDecorator::getVbTableType 75100->75101 75102 7ff660a911a0 _Mpunct 51 API calls 75101->75102 75103 7ff660a9988d 75102->75103 75104 7ff660ad98a0 70 API calls 75103->75104 75105 7ff660a998aa operator== 75104->75105 75106 7ff660a911a0 _Mpunct 51 API calls 75105->75106 75107 7ff660a998dc UnDecorator::getVbTableType 75106->75107 75108 7ff660a911a0 _Mpunct 51 API calls 75107->75108 75109 7ff660a9990f 75108->75109 75110 7ff660ad98a0 70 API calls 75109->75110 75111 7ff660a9992c operator== 75110->75111 75112 7ff660a911a0 _Mpunct 51 API calls 75111->75112 75113 7ff660a99961 UnDecorator::getVbTableType 75112->75113 75114 7ff660a911a0 _Mpunct 51 API calls 75113->75114 75115 7ff660a99994 75114->75115 75116 7ff660ad98a0 70 API calls 75115->75116 75117 7ff660a999b1 operator== 75116->75117 75118 7ff660a911a0 _Mpunct 51 API calls 75117->75118 75119 7ff660a999e6 UnDecorator::getVbTableType 75118->75119 75120 7ff660a911a0 _Mpunct 51 API calls 75119->75120 75121 7ff660a99a19 75120->75121 75122 7ff660ad98a0 70 API calls 75121->75122 75123 7ff660a99a36 operator== 75122->75123 75124 7ff660a911a0 _Mpunct 51 API calls 75123->75124 75125 7ff660a99a6b UnDecorator::getVbTableType 75124->75125 75126 7ff660a99a79 GetClassNameW 75125->75126 75127 7ff660a99ae7 GetWindowTextW 75126->75127 75128 7ff660a99b59 75126->75128 75127->75128 75130 7ff660a99b06 75127->75130 75129 7ff660a910b0 51 API calls 75128->75129 75140 7ff660a99b7e operator== type_info::_name_internal_method UnDecorator::getVbTableType 75129->75140 75131 7ff660a93c10 shared_ptr 47 API calls 75130->75131 75132 7ff660a99b1b 75131->75132 75133 7ff660a93c10 shared_ptr 47 API calls 75132->75133 75134 7ff660a99b29 75133->75134 75135 7ff660a93c10 shared_ptr 47 API calls 75134->75135 75136 7ff660a99b37 75135->75136 75137 7ff660a93c10 shared_ptr 47 API calls 75136->75137 75138 7ff660a99b42 75137->75138 75139 7ff660a93c10 shared_ptr 47 API calls 75138->75139 75195 7ff660a99b50 75139->75195 75141 7ff660a99bf9 EnumChildWindows EnumChildWindows EnumChildWindows 75140->75141 75142 7ff660a99cad 75140->75142 75143 7ff660a93c10 shared_ptr 47 API calls 75141->75143 75144 7ff660a910b0 51 API calls 75142->75144 75151 7ff660a99cde operator== type_info::_name_internal_method UnDecorator::getVbTableType 75142->75151 75145 7ff660a99c6f 75143->75145 75144->75151 75146 7ff660a93c10 shared_ptr 47 API calls 75145->75146 75147 7ff660a99c7d 75146->75147 75148 7ff660a93c10 shared_ptr 47 API calls 75147->75148 75152 7ff660a99c8b 75148->75152 75149 7ff660a99e35 75155 7ff660a93c10 shared_ptr 47 API calls 75149->75155 75150 7ff660a99e97 75159 7ff660a910b0 51 API calls 75150->75159 75168 7ff660a99ecb operator== type_info::_name_internal_method UnDecorator::getVbTableType 75150->75168 75153 7ff660a99d84 operator== type_info::_name_internal_method UnDecorator::getVbTableType 75151->75153 75154 7ff660a910b0 51 API calls 75151->75154 75156 7ff660a93c10 shared_ptr 47 API calls 75152->75156 75153->75149 75153->75150 75154->75153 75157 7ff660a99e59 75155->75157 75158 7ff660a99c96 75156->75158 75160 7ff660a93c10 shared_ptr 47 API calls 75157->75160 75161 7ff660a93c10 shared_ptr 47 API calls 75158->75161 75159->75168 75162 7ff660a99e67 75160->75162 75161->75195 75165 7ff660a93c10 shared_ptr 47 API calls 75162->75165 75163 7ff660a99f5e 75166 7ff660a93c10 shared_ptr 47 API calls 75163->75166 75164 7ff660a99fc0 75170 7ff660a910b0 51 API calls 75164->75170 75173 7ff660a99ff4 operator== type_info::_name_internal_method UnDecorator::getVbTableType 75164->75173 75169 7ff660a99e75 75165->75169 75167 7ff660a99f82 75166->75167 75171 7ff660a93c10 shared_ptr 47 API calls 75167->75171 75168->75163 75168->75164 75172 7ff660a93c10 shared_ptr 47 API calls 75169->75172 75170->75173 75174 7ff660a99f90 75171->75174 75177 7ff660a99e80 75172->75177 75175 7ff660a9a087 75173->75175 75176 7ff660a9a0e6 75173->75176 75178 7ff660a93c10 shared_ptr 47 API calls 75174->75178 75180 7ff660a93c10 shared_ptr 47 API calls 75175->75180 75179 7ff660a93c10 shared_ptr 47 API calls 75176->75179 75181 7ff660a93c10 shared_ptr 47 API calls 75177->75181 75182 7ff660a99f9e 75178->75182 75183 7ff660a9a0fb 75179->75183 75184 7ff660a9a0ab 75180->75184 75181->75195 75185 7ff660a93c10 shared_ptr 47 API calls 75182->75185 75186 7ff660a93c10 shared_ptr 47 API calls 75183->75186 75187 7ff660a93c10 shared_ptr 47 API calls 75184->75187 75188 7ff660a99fa9 75185->75188 75189 7ff660a9a109 75186->75189 75190 7ff660a9a0b9 75187->75190 75191 7ff660a93c10 shared_ptr 47 API calls 75188->75191 75192 7ff660a93c10 shared_ptr 47 API calls 75189->75192 75193 7ff660a93c10 shared_ptr 47 API calls 75190->75193 75191->75195 75196 7ff660a9a117 75192->75196 75194 7ff660a9a0c7 75193->75194 75197 7ff660a93c10 shared_ptr 47 API calls 75194->75197 75198 7ff660a93c10 shared_ptr 47 API calls 75196->75198 75199 7ff660a9a0d2 75197->75199 75200 7ff660a9a122 75198->75200 75201 7ff660a93c10 shared_ptr 47 API calls 75199->75201 75202 7ff660a93c10 shared_ptr 47 API calls 75200->75202 75201->75195 75202->75195 75203 7ff660afc490 GetWindowTextW 75204 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75203->75204 75205 7ff660afc4eb 75204->75205 75206 7ff660ad8e90 70 API calls 75205->75206 75207 7ff660afc4ff operator== type_info::_name_internal_method 75206->75207 75208 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75207->75208 75212 7ff660afc569 operator== type_info::_name_internal_method UnDecorator::getVbTableType 75207->75212 75209 7ff660afc555 75208->75209 75210 7ff660ad8e90 70 API calls 75209->75210 75210->75212 75211 7ff660afc63e 75212->75211 75213 7ff660a911a0 _Mpunct 51 API calls 75212->75213 75214 7ff660afc613 75213->75214 75218 7ff660af8130 51 API calls SafeRWList 75214->75218 75216 7ff660afc626 75217 7ff660a93c10 shared_ptr 47 API calls 75216->75217 75217->75211 75218->75216 75219 7ff660ae42b0 75222 7ff660cb689c 75219->75222 75223 7ff660cb68b8 75222->75223 75224 7ff660cb68d6 75222->75224 75244 7ff660ca90f0 11 API calls _get_daylight 75223->75244 75243 7ff660cb6450 EnterCriticalSection 75224->75243 75228 7ff660cb68bd 75245 7ff660ca8f84 47 API calls _invalid_parameter_noinfo_noreturn 75228->75245 75233 7ff660ae42c8 75244->75228 75245->75233 75246 7ff660b125a0 75254 7ff660a8d210 75246->75254 75248 7ff660b125c1 RegCreateKeyW 75249 7ff660b125dc operator== 75248->75249 75253 7ff660b1263f UnDecorator::getVbTableType 75248->75253 75250 7ff660b125e6 RegSetValueExW 75249->75250 75251 7ff660b12652 RegCloseKey 75250->75251 75252 7ff660b12624 RegCloseKey 75250->75252 75251->75253 75252->75253 75254->75248 75255 7ff660a81270 75256 7ff660a911a0 _Mpunct 51 API calls 75255->75256 75257 7ff660a8128f 75256->75257 75258 7ff660ad98a0 70 API calls 75257->75258 75259 7ff660a812a3 operator== 75258->75259 75260 7ff660a911a0 _Mpunct 51 API calls 75259->75260 75261 7ff660a812cb UnDecorator::getVbTableType 75260->75261 75264 7ff660ca2e3c 75261->75264 75267 7ff660ca2e00 75264->75267 75266 7ff660a812e3 75268 7ff660ca2e1a 75267->75268 75270 7ff660ca2e13 75267->75270 75271 7ff660cc0438 75268->75271 75270->75266 75274 7ff660cc0074 75271->75274 75281 7ff660cba724 EnterCriticalSection 75274->75281 75282 7ff660aa9540 75283 7ff660a911a0 _Mpunct 51 API calls 75282->75283 75284 7ff660aa956a 75283->75284 75285 7ff660ad98a0 70 API calls 75284->75285 75286 7ff660aa957e 75285->75286 75287 7ff660a911a0 _Mpunct 51 API calls 75286->75287 75288 7ff660aa959d 75287->75288 75289 7ff660ad98a0 70 API calls 75288->75289 75290 7ff660aa95b1 75289->75290 75309 7ff660b317a0 ShowWindow 75290->75309 75292 7ff660aa95c6 75293 7ff660a90510 66 API calls 75292->75293 75294 7ff660aa95d8 75293->75294 75295 7ff660a90510 66 API calls 75294->75295 75296 7ff660aa95ea 75295->75296 75297 7ff660a90510 66 API calls 75296->75297 75298 7ff660aa95fc 75297->75298 75299 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75298->75299 75300 7ff660aa9619 75299->75300 75301 7ff660ad8e90 70 API calls 75300->75301 75302 7ff660aa9636 75301->75302 75303 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75302->75303 75304 7ff660aa9680 75303->75304 75305 7ff660ad8e90 70 API calls 75304->75305 75306 7ff660aa969d 75305->75306 75307 7ff660b1ca30 75 API calls 75306->75307 75308 7ff660aa96ee UnDecorator::getVbTableType 75307->75308 75310 7ff660b317ca UpdateWindow 75309->75310 75311 7ff660b317be 75309->75311 75310->75292 75311->75310 75312 7ff660ac1e41 75313 7ff660ac1eb1 75312->75313 75314 7ff660ac1e52 75312->75314 75315 7ff660a95700 type_info::_name_internal_method 7 API calls 75314->75315 75316 7ff660ac1e6c 75315->75316 75320 7ff660ac6d70 75316->75320 75324 7ff660c84e5c 75320->75324 75322 7ff660ac1e85 75323 7ff660ac5a10 13 API calls 2 library calls 75322->75323 75323->75313 75325 7ff660c813e8 std::_Lockit::_Lockit 6 API calls 75324->75325 75326 7ff660c84e85 75325->75326 75327 7ff660c84f47 75326->75327 75330 7ff660c84eb6 75326->75330 75329 7ff660c81810 Concurrency::cancel_current_task 2 API calls 75327->75329 75328 7ff660c81460 std::_Lockit::~_Lockit LeaveCriticalSection 75331 7ff660c84f31 75328->75331 75332 7ff660c84f4c 75329->75332 75330->75328 75331->75322 75333 7ff660a92c70 std::bad_exception::bad_exception 57 API calls 75332->75333 75334 7ff660c84f82 75333->75334 75335 7ff660a94b10 std::bad_exception::bad_exception 19 API calls 75334->75335 75336 7ff660c84fa2 75335->75336 75336->75322 75337 7ff660ac6980 75340 7ff660ac57c0 75337->75340 75339 7ff660ac6997 std::_Throw_Cpp_error 75343 7ff660ac8050 75340->75343 75342 7ff660ac57e2 75342->75339 75344 7ff660ac8064 75343->75344 75347 7ff660ac8072 std::_Throw_Cpp_error 75343->75347 75345 7ff660ca9ad0 __std_exception_destroy 13 API calls 75344->75345 75345->75347 75346 7ff660ca9ad0 __std_exception_destroy 13 API calls 75348 7ff660ac80a7 75346->75348 75347->75346 75348->75342 75349 7ff660a9e340 75350 7ff660a9e395 75349->75350 75351 7ff660a9e36c 75349->75351 75352 7ff660a9e425 75350->75352 75364 7ff660a9e390 75350->75364 75356 7ff660a9e3b6 UnDecorator::getVbTableType 75351->75356 75358 7ff660a9e389 75351->75358 75359 7ff660a9e9ba PostQuitMessage 75351->75359 75354 7ff660a9e434 75352->75354 75355 7ff660a9e6dd 75352->75355 75353 7ff660a9e9ec DefWindowProcW 75360 7ff660a9e414 75353->75360 75357 7ff660a911a0 _Mpunct 51 API calls 75354->75357 75355->75356 75362 7ff660a911a0 _Mpunct 51 API calls 75355->75362 75356->75353 75363 7ff660a9e458 75357->75363 75358->75364 75365 7ff660a9e3bb 75358->75365 75359->75353 75361 7ff660a9e9c5 DefWindowProcW 75361->75353 75361->75360 75366 7ff660a9e710 75362->75366 75367 7ff660ad98a0 70 API calls 75363->75367 75364->75356 75364->75361 75368 7ff660a9e3ef 75365->75368 75369 7ff660a9e3d3 PostMessageW 75365->75369 75371 7ff660ad98a0 70 API calls 75366->75371 75372 7ff660a9e472 75367->75372 75368->75360 75370 7ff660a9e3fa PostMessageW 75368->75370 75369->75360 75370->75360 75373 7ff660a9e72d 75371->75373 75374 7ff660a911a0 _Mpunct 51 API calls 75372->75374 75375 7ff660a911a0 _Mpunct 51 API calls 75373->75375 75376 7ff660a9e497 75374->75376 75377 7ff660a9e752 75375->75377 75378 7ff660ad98a0 70 API calls 75376->75378 75379 7ff660ad98a0 70 API calls 75377->75379 75380 7ff660a9e4b1 75378->75380 75381 7ff660a9e76c 75379->75381 75382 7ff660a911a0 _Mpunct 51 API calls 75380->75382 75383 7ff660a911a0 _Mpunct 51 API calls 75381->75383 75384 7ff660a9e4d6 75382->75384 75385 7ff660a9e791 75383->75385 75386 7ff660ad98a0 70 API calls 75384->75386 75388 7ff660ad98a0 70 API calls 75385->75388 75387 7ff660a9e4f0 75386->75387 75390 7ff660a90510 66 API calls 75387->75390 75389 7ff660a9e7ab 75388->75389 75391 7ff660a90510 66 API calls 75389->75391 75392 7ff660a9e502 75390->75392 75393 7ff660a9e7bd 75391->75393 75394 7ff660a90510 66 API calls 75392->75394 75395 7ff660a90510 66 API calls 75393->75395 75396 7ff660a9e514 75394->75396 75397 7ff660a9e7cf 75395->75397 75398 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75396->75398 75399 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75397->75399 75400 7ff660a9e537 75398->75400 75401 7ff660a9e7f2 75399->75401 75402 7ff660ad8e90 70 API calls 75400->75402 75403 7ff660ad8e90 70 API calls 75401->75403 75404 7ff660a9e554 75402->75404 75405 7ff660a9e80f 75403->75405 75406 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75404->75406 75407 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75405->75407 75408 7ff660a9e59e 75406->75408 75409 7ff660a9e859 75407->75409 75410 7ff660ad8e90 70 API calls 75408->75410 75411 7ff660ad8e90 70 API calls 75409->75411 75412 7ff660a9e5bb 75410->75412 75413 7ff660a9e876 75411->75413 75414 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75412->75414 75415 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75413->75415 75416 7ff660a9e605 75414->75416 75417 7ff660a9e8c3 75415->75417 75418 7ff660ad8e90 70 API calls 75416->75418 75420 7ff660ad8e90 70 API calls 75417->75420 75419 7ff660a9e622 75418->75419 75424 7ff660b1d350 88 API calls 5 library calls 75419->75424 75421 7ff660a9e8e0 75420->75421 75425 7ff660b1d350 88 API calls 5 library calls 75421->75425 75424->75356 75425->75356 75426 7ff660a9ffe0 75429 7ff660c8219c 75426->75429 75430 7ff660cbab18 _Getctype 47 API calls 75429->75430 75431 7ff660c821aa 75430->75431 75432 7ff660c82229 75431->75432 75433 7ff660c821c4 75431->75433 75442 7ff660cbaae8 47 API calls _Getctype 75432->75442 75441 7ff660cbaae8 47 API calls _Getctype 75433->75441 75436 7ff660c821c9 75437 7ff660cbab78 _Getctype 47 API calls 75436->75437 75438 7ff660c8223b 75437->75438 75439 7ff660a9fffa 75438->75439 75443 7ff660cbb240 47 API calls 2 library calls 75438->75443 75441->75436 75442->75436 75443->75439 75444 7ff660aeee00 75447 7ff660af8c10 CoUninitialize 75444->75447 75446 7ff660aeee13 75447->75446 75448 7ff660ad6660 75451 7ff660ad1ee0 75448->75451 75454 7ff660acfd80 75451->75454 75455 7ff660acfd94 SafeRWList 75454->75455 75458 7ff660ad00a0 75455->75458 75459 7ff660ad00c6 SafeRWList _aligned_msize 75458->75459 75462 7ff660ad0010 75459->75462 75465 7ff660ad1bd0 75462->75465 75466 7ff660ad1c0a 75465->75466 75467 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75466->75467 75468 7ff660ad1c9a 75467->75468 75469 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75468->75469 75470 7ff660ad1ce7 75469->75470 75471 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75470->75471 75472 7ff660ad1d42 75471->75472 75473 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75472->75473 75474 7ff660ad1d8f 75473->75474 75475 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75474->75475 75476 7ff660ad1ddc 75475->75476 75479 7ff660ad3d10 75476->75479 75480 7ff660ad3d2f ctype std::_Fac_node::_Fac_node 75479->75480 75481 7ff660ad3d97 CoInitializeEx 75480->75481 75482 7ff660a911a0 _Mpunct 51 API calls 75481->75482 75483 7ff660ad3dca 75482->75483 75484 7ff660ad98a0 70 API calls 75483->75484 75485 7ff660ad3de4 75484->75485 75486 7ff660a911a0 _Mpunct 51 API calls 75485->75486 75487 7ff660ad3e09 75486->75487 75488 7ff660ad98a0 70 API calls 75487->75488 75489 7ff660ad3e26 75488->75489 75490 7ff660a905d0 59 API calls 75489->75490 75491 7ff660ad3e31 operator== 75490->75491 75492 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75491->75492 75493 7ff660ad3e6c 75492->75493 75494 7ff660ad8e90 70 API calls 75493->75494 75495 7ff660ad3e89 operator== 75494->75495 75496 7ff660a9a250 68 API calls 75495->75496 75497 7ff660ad3ee4 UnDecorator::getVbTableType 75496->75497 75498 7ff660a911a0 _Mpunct 51 API calls 75497->75498 75499 7ff660ad3f21 75498->75499 75500 7ff660ad98a0 70 API calls 75499->75500 75501 7ff660ad3f3b 75500->75501 75502 7ff660a911a0 _Mpunct 51 API calls 75501->75502 75503 7ff660ad3f60 75502->75503 75504 7ff660ad98a0 70 API calls 75503->75504 75505 7ff660ad3f7d 75504->75505 75506 7ff660a911a0 _Mpunct 51 API calls 75505->75506 75507 7ff660ad3fa9 75506->75507 75508 7ff660ad98a0 70 API calls 75507->75508 75509 7ff660ad3fc6 75508->75509 75510 7ff660a905d0 59 API calls 75509->75510 75511 7ff660ad3fd8 75510->75511 75791 7ff660ad6ea0 51 API calls type_info::_name_internal_method 75511->75791 75513 7ff660ad3ffb operator== 75514 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75513->75514 75515 7ff660ad4060 75514->75515 75516 7ff660ad8e90 70 API calls 75515->75516 75517 7ff660ad407d operator== 75516->75517 75518 7ff660a9a250 68 API calls 75517->75518 75519 7ff660ad40d9 UnDecorator::getVbTableType 75518->75519 75520 7ff660a90510 66 API calls 75519->75520 75521 7ff660ad40fc 75520->75521 75522 7ff660a90510 66 API calls 75521->75522 75523 7ff660ad4118 75522->75523 75524 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75523->75524 75525 7ff660ad4145 75524->75525 75526 7ff660ad8e90 70 API calls 75525->75526 75527 7ff660ad4162 75526->75527 75528 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75527->75528 75529 7ff660ad41ac 75528->75529 75530 7ff660ad8e90 70 API calls 75529->75530 75531 7ff660ad41c9 75530->75531 75532 7ff660b1ca30 75 API calls 75531->75532 75533 7ff660ad4220 UnDecorator::getVbTableType 75532->75533 75534 7ff660a905d0 59 API calls 75533->75534 75535 7ff660ad4266 operator== 75534->75535 75792 7ff660ad6ea0 51 API calls type_info::_name_internal_method 75535->75792 75537 7ff660ad429e 75538 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75537->75538 75539 7ff660ad42eb 75538->75539 75540 7ff660ad8e90 70 API calls 75539->75540 75541 7ff660ad4308 operator== 75540->75541 75542 7ff660a9a250 68 API calls 75541->75542 75543 7ff660ad4362 UnDecorator::getVbTableType 75542->75543 75544 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75543->75544 75545 7ff660ad43ac 75544->75545 75546 7ff660b2db90 80 API calls 75545->75546 75547 7ff660ad43e1 75546->75547 75793 7ff660ad2880 59 API calls SafeRWList 75547->75793 75549 7ff660ad448e 75794 7ff660b095b0 75549->75794 75791->75513 75792->75537 75793->75549 75795 7ff660b095e1 75794->75795 76016 7ff660acca20 75795->76016 75798 7ff660a90510 66 API calls 75799 7ff660b0961a operator== 75798->75799 76023 7ff660af43b0 75799->76023 75801 7ff660b0963e 76028 7ff660aef650 75801->76028 76019 7ff660acca40 std::ios_base::good 76016->76019 76017 7ff660acca9d 76020 7ff660a93c10 shared_ptr 47 API calls 76017->76020 76019->76017 76078 7ff660ac62d0 RtlPcToFileHeader RaiseException strrchr std::ios_base::good 76019->76078 76079 7ff660ac6690 51 API calls 76019->76079 76022 7ff660accac1 76020->76022 76022->75798 76080 7ff660af4fb0 76023->76080 76025 7ff660af43e0 76083 7ff660ae7950 76025->76083 76029 7ff660aef675 SafeRWList 76028->76029 76116 7ff660ae7850 76029->76116 76078->76019 76079->76019 76090 7ff660af3b40 76080->76090 76095 7ff660af3950 76083->76095 76085 7ff660ae799f 76101 7ff660affb00 76085->76101 76087 7ff660ae79aa 76113 7ff660af6b20 76087->76113 76091 7ff660a93410 std::ios_base::_Init 59 API calls 76090->76091 76092 7ff660af3b5a 76091->76092 76093 7ff660afe5a0 58 API calls 76092->76093 76094 7ff660af3b65 76093->76094 76094->76025 76096 7ff660af39c1 SafeRWList 76095->76096 76097 7ff660af5220 51 API calls 76096->76097 76098 7ff660af39d0 76097->76098 76099 7ff660af35f0 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 76098->76099 76100 7ff660af39f6 _Bitmask_includes 76099->76100 76100->76085 76102 7ff660affb23 SafeRWList 76101->76102 76103 7ff660afdf30 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 76102->76103 76104 7ff660affb42 76103->76104 76105 7ff660affe90 51 API calls 76104->76105 76106 7ff660affb51 76105->76106 76107 7ff660affb74 76106->76107 76108 7ff660b017e0 51 API calls 76106->76108 76109 7ff660b01420 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 76107->76109 76108->76107 76110 7ff660affb92 76109->76110 76111 7ff660b014d0 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 76110->76111 76112 7ff660affba3 76111->76112 76112->76087 76114 7ff660af72e0 47 API calls 76113->76114 76115 7ff660ae79cc 76114->76115 76115->75801 76138 7ff660adaf80 76139 7ff660a911a0 _Mpunct 51 API calls 76138->76139 76140 7ff660adafaa 76139->76140 76141 7ff660ad98a0 70 API calls 76140->76141 76142 7ff660adafbe 76141->76142 76143 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76142->76143 76144 7ff660adafd8 76143->76144 76145 7ff660ad8e90 70 API calls 76144->76145 76146 7ff660adafec operator== 76145->76146 76147 7ff660adaffb WinHttpOpen 76146->76147 76148 7ff660adb02d UnDecorator::getVbTableType 76147->76148 76149 7ff660adb040 UnDecorator::getVbTableType 76148->76149 76150 7ff660adb058 WinHttpSetTimeouts 76148->76150 76150->76149 76151 7ff660adb0c0 76152 7ff660adb0d8 76151->76152 76154 7ff660adb0df Concurrency::details::WorkQueue::IsStructuredEmpty 76151->76154 76153 7ff660adb1d7 WaitForSingleObject 76153->76152 76153->76154 76154->76153 76156 7ff660ad7740 ReleaseSRWLockExclusive 76154->76156 76158 7ff660ad7690 57 API calls 76154->76158 76159 7ff660adab80 76154->76159 76172 7ff660adbe70 76154->76172 76156->76154 76158->76154 76160 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76159->76160 76161 7ff660adabaa 76160->76161 76162 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76161->76162 76163 7ff660adabcf 76162->76163 76164 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76163->76164 76165 7ff660adabf4 76164->76165 76166 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76165->76166 76167 7ff660adac19 76166->76167 76168 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76167->76168 76169 7ff660adac3e 76168->76169 76170 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76169->76170 76171 7ff660adac63 76170->76171 76171->76154 76173 7ff660adbeb1 operator== std::ios_base::good 76172->76173 76194 7ff660adbf50 UnDecorator::getVbTableType 76172->76194 76174 7ff660adbf0c WinHttpConnect 76173->76174 76175 7ff660adbf57 76174->76175 76176 7ff660a905d0 59 API calls 76175->76176 76175->76194 76177 7ff660adbf6d GetTickCount64 76176->76177 76178 7ff660adc2b6 operator== std::ios_base::good 76177->76178 76179 7ff660a9a250 68 API calls 76178->76179 76180 7ff660adc387 operator== 76179->76180 76181 7ff660adc392 WinHttpOpenRequest 76180->76181 76182 7ff660adc3d1 WinHttpSetTimeouts 76181->76182 76186 7ff660adc43c UnDecorator::getVbTableType 76181->76186 76183 7ff660adc3f9 76182->76183 76182->76186 76184 7ff660adc401 WinHttpCloseHandle 76183->76184 76185 7ff660adc40d 76183->76185 76184->76185 76187 7ff660adc415 WinHttpCloseHandle 76185->76187 76185->76194 76188 7ff660adc485 76186->76188 76189 7ff660adc455 WinHttpSendRequest 76186->76189 76187->76194 76190 7ff660adc49d 76188->76190 76191 7ff660adc48c WinHttpReceiveResponse 76188->76191 76189->76188 76192 7ff660adc4a5 WinHttpCloseHandle 76190->76192 76193 7ff660adc4b1 76190->76193 76191->76190 76192->76193 76193->76194 76195 7ff660adc4b9 WinHttpCloseHandle 76193->76195 76194->76154 76195->76194 76196 7ff660acc9b7 76205 7ff660accb50 76196->76205 76198 7ff660acc9cb std::_Throw_Cpp_error 76199 7ff660a93be0 std::ios_base::failure::failure 47 API calls 76198->76199 76200 7ff660acc9f2 76199->76200 76209 7ff660ac5890 76200->76209 76202 7ff660acc9fd 76203 7ff660a93c10 shared_ptr 47 API calls 76202->76203 76204 7ff660acca08 76203->76204 76206 7ff660accb75 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 76205->76206 76214 7ff660accbc0 76206->76214 76210 7ff660a93c10 shared_ptr 47 API calls 76209->76210 76211 7ff660ac58b9 76210->76211 76212 7ff660a93be0 std::ios_base::failure::failure 47 API calls 76211->76212 76213 7ff660ac58ca type_info::_name_internal_method 76212->76213 76213->76202 76215 7ff660accbee 76214->76215 76250 7ff660aa2bd0 76215->76250 76217 7ff660a93be0 std::ios_base::failure::failure 47 API calls 76218 7ff660accf18 76217->76218 76219 7ff660a93be0 std::ios_base::failure::failure 47 API calls 76218->76219 76221 7ff660accba4 76219->76221 76220 7ff660accc51 Concurrency::details::HardwareAffinity::operator!= 76222 7ff660accd6d 76220->76222 76223 7ff660accd5d 76220->76223 76228 7ff660accd9e std::_Throw_Cpp_error 76220->76228 76221->76198 76224 7ff660accda4 Concurrency::details::HardwareAffinity::operator!= 76222->76224 76225 7ff660accd79 76222->76225 76226 7ff660accd68 76223->76226 76239 7ff660acce39 76223->76239 76229 7ff660accdb4 76224->76229 76230 7ff660accdc9 76224->76230 76254 7ff660aa2ad0 51 API calls 4 library calls 76225->76254 76231 7ff660acce8e 76226->76231 76232 7ff660acced9 76226->76232 76228->76217 76234 7ff660aa2bd0 51 API calls 76229->76234 76236 7ff660acce27 76230->76236 76237 7ff660accdd9 76230->76237 76238 7ff660a90e90 std::_Throw_Cpp_error 51 API calls 76231->76238 76257 7ff660ac7f30 51 API calls 2 library calls 76232->76257 76234->76228 76255 7ff660ac7f30 51 API calls 2 library calls 76236->76255 76240 7ff660a90e90 std::_Throw_Cpp_error 51 API calls 76237->76240 76241 7ff660acceaa 76238->76241 76239->76228 76256 7ff660ac0c70 51 API calls 3 library calls 76239->76256 76243 7ff660accdf5 76240->76243 76244 7ff660a93be0 std::ios_base::failure::failure 47 API calls 76241->76244 76245 7ff660a93be0 std::ios_base::failure::failure 47 API calls 76243->76245 76246 7ff660accec2 76244->76246 76247 7ff660acce0d 76245->76247 76248 7ff660a93be0 std::ios_base::failure::failure 47 API calls 76246->76248 76249 7ff660a93be0 std::ios_base::failure::failure 47 API calls 76247->76249 76248->76221 76249->76221 76251 7ff660aa2c92 76250->76251 76253 7ff660aa2c0e Concurrency::details::WorkQueue::IsStructuredEmpty char_traits 76250->76253 76258 7ff660a8e5c0 51 API calls 5 library calls 76251->76258 76253->76220 76254->76228 76255->76228 76256->76239 76257->76228 76258->76253 76259 7ff660a81080 76264 7ff660c65a90 76259->76264 76265 7ff660a911a0 _Mpunct 51 API calls 76264->76265 76266 7ff660c65aca 76265->76266 76267 7ff660ad98a0 70 API calls 76266->76267 76268 7ff660c65ae7 76267->76268 76269 7ff660a911a0 _Mpunct 51 API calls 76268->76269 76270 7ff660c65b0c 76269->76270 76271 7ff660ad98a0 70 API calls 76270->76271 76272 7ff660c65b29 76271->76272 76273 7ff660a911a0 _Mpunct 51 API calls 76272->76273 76274 7ff660c65b4e 76273->76274 76275 7ff660ad98a0 70 API calls 76274->76275 76276 7ff660c65b6b 76275->76276 76277 7ff660a911a0 _Mpunct 51 API calls 76276->76277 76278 7ff660c65b90 76277->76278 76279 7ff660ad98a0 70 API calls 76278->76279 76280 7ff660c65bad 76279->76280 76281 7ff660a911a0 _Mpunct 51 API calls 76280->76281 76282 7ff660c65bd2 76281->76282 76283 7ff660ad98a0 70 API calls 76282->76283 76284 7ff660c65bef 76283->76284 76285 7ff660a911a0 _Mpunct 51 API calls 76284->76285 76286 7ff660c65c14 76285->76286 76287 7ff660ad98a0 70 API calls 76286->76287 76288 7ff660c65c31 76287->76288 76289 7ff660a911a0 _Mpunct 51 API calls 76288->76289 76290 7ff660c65c56 76289->76290 76291 7ff660ad98a0 70 API calls 76290->76291 76292 7ff660c65c73 76291->76292 76293 7ff660a911a0 _Mpunct 51 API calls 76292->76293 76294 7ff660c65c98 76293->76294 76295 7ff660ad98a0 70 API calls 76294->76295 76296 7ff660c65cb5 76295->76296 76297 7ff660a911a0 _Mpunct 51 API calls 76296->76297 76298 7ff660c65cda 76297->76298 76299 7ff660ad98a0 70 API calls 76298->76299 76300 7ff660c65cf7 76299->76300 76301 7ff660a911a0 _Mpunct 51 API calls 76300->76301 76302 7ff660c65d1c 76301->76302 76303 7ff660ad98a0 70 API calls 76302->76303 76304 7ff660c65d39 76303->76304 76305 7ff660a911a0 _Mpunct 51 API calls 76304->76305 76306 7ff660c65d5e 76305->76306 76307 7ff660ad98a0 70 API calls 76306->76307 76308 7ff660c65d7b 76307->76308 76309 7ff660a911a0 _Mpunct 51 API calls 76308->76309 76310 7ff660c65da0 76309->76310 76311 7ff660ad98a0 70 API calls 76310->76311 76312 7ff660c65dbd 76311->76312 76313 7ff660a911a0 _Mpunct 51 API calls 76312->76313 76314 7ff660c65de2 76313->76314 76315 7ff660ad98a0 70 API calls 76314->76315 76316 7ff660c65dfc 76315->76316 76317 7ff660a911a0 _Mpunct 51 API calls 76316->76317 76318 7ff660c65e21 76317->76318 76319 7ff660ad98a0 70 API calls 76318->76319 76320 7ff660c65e3b 76319->76320 76321 7ff660a911a0 _Mpunct 51 API calls 76320->76321 76322 7ff660c65e60 76321->76322 76323 7ff660ad98a0 70 API calls 76322->76323 76324 7ff660c65e7a 76323->76324 76325 7ff660a911a0 _Mpunct 51 API calls 76324->76325 76326 7ff660c65e9f 76325->76326 76327 7ff660ad98a0 70 API calls 76326->76327 76328 7ff660c65eb9 76327->76328 76329 7ff660a911a0 _Mpunct 51 API calls 76328->76329 76330 7ff660c65ede 76329->76330 76331 7ff660ad98a0 70 API calls 76330->76331 76332 7ff660c65ef8 76331->76332 76333 7ff660a911a0 _Mpunct 51 API calls 76332->76333 76334 7ff660c65f1d 76333->76334 76335 7ff660ad98a0 70 API calls 76334->76335 76336 7ff660c65f37 76335->76336 76337 7ff660a911a0 _Mpunct 51 API calls 76336->76337 76338 7ff660c65f5c 76337->76338 76339 7ff660ad98a0 70 API calls 76338->76339 76340 7ff660c65f76 76339->76340 76341 7ff660a911a0 _Mpunct 51 API calls 76340->76341 76342 7ff660c65f9b 76341->76342 76343 7ff660ad98a0 70 API calls 76342->76343 76344 7ff660c65fb5 76343->76344 76345 7ff660a911a0 _Mpunct 51 API calls 76344->76345 76346 7ff660c65fda 76345->76346 76347 7ff660ad98a0 70 API calls 76346->76347 76348 7ff660c65ff4 76347->76348 76349 7ff660a911a0 _Mpunct 51 API calls 76348->76349 76350 7ff660c66019 76349->76350 76351 7ff660ad98a0 70 API calls 76350->76351 76352 7ff660c66033 76351->76352 76353 7ff660a911a0 _Mpunct 51 API calls 76352->76353 76354 7ff660c66058 76353->76354 76355 7ff660ad98a0 70 API calls 76354->76355 76356 7ff660c66072 SafeRWList 76355->76356 76357 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76356->76357 76358 7ff660c6609a 76357->76358 76359 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76358->76359 76360 7ff660c660b0 76359->76360 76361 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76360->76361 76362 7ff660c660c6 76361->76362 76363 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76362->76363 76364 7ff660c660dc 76363->76364 76365 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76364->76365 76366 7ff660c660f2 76365->76366 76367 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76366->76367 76368 7ff660c66108 76367->76368 76369 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76368->76369 76370 7ff660c6611e 76369->76370 76371 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76370->76371 76372 7ff660c66134 76371->76372 76373 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76372->76373 76374 7ff660c6614a 76373->76374 76375 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76374->76375 76376 7ff660c66160 76375->76376 76377 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76376->76377 76378 7ff660c66176 76377->76378 76379 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76378->76379 76380 7ff660c6618c 76379->76380 76381 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76380->76381 76382 7ff660c6619f 76381->76382 76383 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76382->76383 76384 7ff660c661b2 76383->76384 76385 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76384->76385 76386 7ff660c661c5 76385->76386 76387 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76386->76387 76388 7ff660c661d8 76387->76388 76389 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76388->76389 76390 7ff660c661eb 76389->76390 76391 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76390->76391 76392 7ff660c661fe 76391->76392 76393 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76392->76393 76394 7ff660c66211 76393->76394 76395 7ff660a90450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 76394->76395 76396 7ff660c66224 76395->76396

                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                          Function 00007FF660B095B0 Relevance: 88.4, APIs: 39, Strings: 11, Instructions: 865timeCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 0 7ff660b095b0-7ff660b09672 call 7ff660a91200 * 2 call 7ff660acca20 call 7ff660a90510 call 7ff660a8d210 call 7ff660af43b0 call 7ff660af4e20 call 7ff660aef650 17 7ff660b09678-7ff660b096dc call 7ff660af8170 call 7ff660b15ad0 call 7ff660aa5cb0 0->17 18 7ff660b09741 0->18 17->18 40 7ff660b096de-7ff660b09732 call 7ff660af8170 call 7ff660b15ad0 call 7ff660aa5cb0 17->40 19 7ff660b0974c-7ff660b09761 18->19 21 7ff660b09776-7ff660b0977f 19->21 22 7ff660b09763-7ff660b09775 call 7ff660a93c10 19->22 26 7ff660b09781-7ff660b09793 call 7ff660a93c10 21->26 27 7ff660b09794-7ff660b0979b 21->27 22->21 26->27 29 7ff660b097a1-7ff660b0982d call 7ff660b15a70 call 7ff660a95040 call 7ff660a93c10 call 7ff660b15a70 call 7ff660a95040 call 7ff660a93c10 27->29 30 7ff660b09832-7ff660b09974 call 7ff660a905d0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a8d210 call 7ff660a9a250 call 7ff660a93680 call 7ff660add390 call 7ff660ca3da0 call 7ff660a93680 * 2 27->30 68 7ff660b09975-7ff660b09a40 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a8d210 WinHttpOpen call 7ff660a93680 29->68 30->68 40->18 61 7ff660b09734-7ff660b0973f 40->61 61->19 93 7ff660b09a46-7ff660b09b4c call 7ff660a911a0 call 7ff660ad98a0 GetLastError call 7ff660a90450 call 7ff660ad8e90 call 7ff660add3e0 call 7ff660ca3da0 call 7ff660a93680 * 2 68->93 94 7ff660b09b4d-7ff660b09b73 WinHttpSetTimeouts 68->94 93->94 96 7ff660b09b79-7ff660b09c8b WinHttpCloseHandle call 7ff660a911a0 call 7ff660ad98a0 GetLastError call 7ff660a90450 call 7ff660ad8e90 call 7ff660add3e0 call 7ff660ca3da0 call 7ff660a93680 * 2 94->96 97 7ff660b09c8c-7ff660b09cba call 7ff660aa3200 WinHttpConnect 94->97 96->97 106 7ff660b09cc0-7ff660b09dd2 WinHttpCloseHandle call 7ff660a911a0 call 7ff660ad98a0 GetLastError call 7ff660a90450 call 7ff660ad8e90 call 7ff660add3e0 call 7ff660ca3da0 call 7ff660a93680 * 2 97->106 107 7ff660b09dd3-7ff660b09eda call 7ff660a911a0 call 7ff660ad98a0 call 7ff660aa3200 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a8d210 WinHttpOpenRequest call 7ff660a93680 97->107 106->107 162 7ff660b09ffe-7ff660b0a038 WinHttpSendRequest 107->162 163 7ff660b09ee0-7ff660b09ffd WinHttpCloseHandle * 2 call 7ff660a911a0 call 7ff660ad98a0 GetLastError call 7ff660a90450 call 7ff660ad8e90 call 7ff660add3e0 call 7ff660ca3da0 call 7ff660a93680 * 2 107->163 166 7ff660b0a1a8-7ff660b0a2d0 WinHttpCloseHandle * 3 call 7ff660a911a0 call 7ff660ad98a0 GetLastError call 7ff660a90450 call 7ff660ad8e90 call 7ff660add3e0 call 7ff660ca3da0 call 7ff660a93680 * 2 162->166 167 7ff660b0a03e-7ff660b0a04d WinHttpReceiveResponse 162->167 163->162 177 7ff660b0a2d1-7ff660b0a304 call 7ff660a91680 call 7ff660af42e0 166->177 167->166 170 7ff660b0a053-7ff660b0a09c WinHttpQueryHeaders 167->170 171 7ff660b0a0a2-7ff660b0a0ab GetLastError 170->171 172 7ff660b0a1a3 170->172 171->172 176 7ff660b0a0b1-7ff660b0a0b6 171->176 172->177 176->172 180 7ff660b0a0bc-7ff660b0a14d call 7ff660a91200 call 7ff660aac710 call 7ff660aac1b0 call 7ff660aa3200 WinHttpQueryHeaders call 7ff660aac710 176->180 198 7ff660b0a30a-7ff660b0a389 call 7ff660a8d210 call 7ff660af41a0 call 7ff660af78d0 call 7ff660af9330 call 7ff660b0e640 177->198 199 7ff660b0a493-7ff660b0a4bb call 7ff660a91390 call 7ff660af83c0 177->199 237 7ff660b0a14f-7ff660b0a194 call 7ff660af45f0 call 7ff660af7cb0 call 7ff660ad60e0 180->237 238 7ff660b0a195-7ff660b0a1a2 call 7ff660a93c10 180->238 198->199 261 7ff660b0a38f-7ff660b0a492 WinHttpCloseHandle * 3 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660add390 call 7ff660ca3da0 call 7ff660a93680 * 2 198->261 224 7ff660b0a4bd-7ff660b0a4e0 call 7ff660ade7c0 199->224 225 7ff660b0a4e1-7ff660b0a4ed 199->225 224->225 227 7ff660b0a4f2-7ff660b0a504 call 7ff660af8ed0 225->227 244 7ff660b0a50a-7ff660b0a524 WinHttpQueryDataAvailable 227->244 245 7ff660b0a84b-7ff660b0a855 227->245 237->238 238->172 252 7ff660b0a52a-7ff660b0a630 call 7ff660a911a0 call 7ff660ad98a0 GetLastError call 7ff660a90450 call 7ff660ad8e90 call 7ff660add3e0 call 7ff660ca3da0 call 7ff660a93680 * 2 244->252 253 7ff660b0a631-7ff660b0a636 244->253 250 7ff660b0a857-7ff660b0a864 call 7ff660b06510 245->250 251 7ff660b0a865-7ff660b0a952 WinHttpCloseHandle * 3 call 7ff660a93ce0 call 7ff660af9330 call 7ff660ab9470 call 7ff660a93680 * 2 call 7ff660af71a0 call 7ff660af6f70 call 7ff660a93680 call 7ff660a93c10 * 3 call 7ff660a93ce0 * 2 245->251 250->251 252->253 259 7ff660b0a638-7ff660b0a63d 253->259 260 7ff660b0a642-7ff660b0a6c4 call 7ff660abbc10 call 7ff660b12b60 call 7ff660b12c10 call 7ff660b15190 call 7ff660aa2900 WinHttpReadData 253->260 259->245 308 7ff660b0a6ca-7ff660b0a6d4 260->308 309 7ff660b0a83f-7ff660b0a844 260->309 261->199 313 7ff660b0a6da-7ff660b0a72b call 7ff660aa2900 call 7ff660b174d0 call 7ff660af83c0 308->313 314 7ff660b0a770-7ff660b0a846 call 7ff660a91200 call 7ff660abf420 call 7ff660abb5c0 call 7ff660aea240 call 7ff660aa3200 call 7ff660b174d0 call 7ff660a93c10 308->314 309->245 313->314 342 7ff660b0a72d-7ff660b0a736 313->342 314->227 342->314 345 7ff660b0a738-7ff660b0a76f call 7ff660af8e40 342->345 345->314
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Http$CloseHandle$Concurrency::details::EmptyErrorLastQueue::StructuredWork$shared_ptr$Query$Concurrency::details::_CriticalDataHeadersLock::_OpenReentrantRequestScoped_lockScoped_lock::~_type_info::_name_internal_method$AvailableChar_traitsConnectDecorator::getExceptionFileHeaderListRaiseReadReceiveResponseSafeSendTableTimeoutsType
                                                                                                                                                                                                                          • String ID: GET$URL format is not valid : %ws$WinHTTP 1.0$^(https?://(?:www.)?([^/]+))(/.*)?$$file creation failure$handle connection failure$handle initialization failure$handle request creation failure$handle request or response failure$query data not available$timeout init failure
                                                                                                                                                                                                                          • API String ID: 5397687-202491335
                                                                                                                                                                                                                          • Opcode ID: dfc935871b3932ad679c7a19cd0f7e93ccd8b685acfe70352a6c5eebc06737a2
                                                                                                                                                                                                                          • Instruction ID: 28469932823383e30d68461e9e88296a0ee4a6d577a11f3e8b9e29b9c5fc4230
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dfc935871b3932ad679c7a19cd0f7e93ccd8b685acfe70352a6c5eebc06737a2
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DBA2D43261DAC2E5EA709B10E8903EBB374FBC5780F405536D68D8ABAADF2DD545CB40
                                                                                                                                                                                                                          Function 00007FF660AEBFE0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 210libraryloaderCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 2706 7ff660aebfe0-7ff660aec003 2707 7ff660aec005-7ff660aec04d call 7ff660a92a70 2706->2707 2708 7ff660aec052-7ff660aec09a call 7ff660aeef00 2706->2708 2715 7ff660aec41c-7ff660aec423 2707->2715 2714 7ff660aec0a4-7ff660aec0d1 call 7ff660a92a70 call 7ff660ab0720 * 2 2708->2714 2722 7ff660aec17c-7ff660aec188 call 7ff660ab0720 2714->2722 2723 7ff660aec0d7-7ff660aec0fd LoadLibraryW GetProcAddress 2714->2723 2728 7ff660aec18a-7ff660aec1a1 call 7ff660a92a70 2722->2728 2729 7ff660aec1a6-7ff660aec209 call 7ff660af4790 call 7ff660b120d0 call 7ff660cd387c call 7ff660a8bc20 * 2 call 7ff660ade190 2722->2729 2724 7ff660aec0ff-7ff660aec115 2723->2724 2725 7ff660aec11a-7ff660aec178 call 7ff660a92a70 2723->2725 2724->2715 2725->2722 2728->2715 2748 7ff660aec212-7ff660aec232 call 7ff660b12fb0 2729->2748 2751 7ff660aec3de-7ff660aec414 call 7ff660a8d210 call 7ff660cd3882 call 7ff660a93c10 call 7ff660af7010 2748->2751 2752 7ff660aec238-7ff660aec2a8 call 7ff660aac710 call 7ff660a97170 call 7ff660aa3200 LoadLibraryW call 7ff660a902f0 call 7ff660aaa8b0 call 7ff660aac710 call 7ff660af8400 2748->2752 2751->2715 2775 7ff660aec2ba-7ff660aec2de call 7ff660a8d210 GetProcAddress 2752->2775 2776 7ff660aec2aa-7ff660aec2b5 call 7ff660af7090 2752->2776 2781 7ff660aec2f0-7ff660aec348 call 7ff660af4790 call 7ff660b120d0 2775->2781 2782 7ff660aec2e0-7ff660aec2eb call 7ff660af7090 2775->2782 2776->2748 2790 7ff660aec364-7ff660aec3c2 call 7ff660aabcd0 call 7ff660b07f50 call 7ff660a92a70 call 7ff660af7010 call 7ff660af7090 call 7ff660a93c10 call 7ff660af7010 2781->2790 2791 7ff660aec34a-7ff660aec35f call 7ff660af7010 call 7ff660af7090 2781->2791 2782->2748 2790->2715 2791->2748
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: atomic$AddressLibraryLoadProc
                                                                                                                                                                                                                          • String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll$combase.dll
                                                                                                                                                                                                                          • API String ID: 1653574484-4170001172
                                                                                                                                                                                                                          • Opcode ID: 8fab117c1cdc8e3682f0ec68a2ac1de93d45519c69ca58d2309001f4c9a9c856
                                                                                                                                                                                                                          • Instruction ID: cccd5755b6663cd345bbfe61a200dcde76949f13a7b47c8b81796e505037618f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8fab117c1cdc8e3682f0ec68a2ac1de93d45519c69ca58d2309001f4c9a9c856
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6BB1EA2361CA86E1DA60EB15E4503AEA774FBD57D0F404132E68E8BBAADF3CD545CB40
                                                                                                                                                                                                                          Function 00007FF660B31860 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 59memoryCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: GlobalResource$LockName$AllocCreateErrorFindLastLoadNodeNode::SizeofStreamUnlock
                                                                                                                                                                                                                          • String ID: &$PNG
                                                                                                                                                                                                                          • API String ID: 404809873-3047161795
                                                                                                                                                                                                                          • Opcode ID: a2c06dc25bda38559360ae671d947d6f58e99bb9c09f315c507cbfd297364e45
                                                                                                                                                                                                                          • Instruction ID: eca0538b0a6ad73f9df4954c2a1283930edc55ba92293ab55463cdcf7459d880
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a2c06dc25bda38559360ae671d947d6f58e99bb9c09f315c507cbfd297364e45
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DC31E276618B85D6DB609B11F49532BB7B4FB88B90F104039EA8E87B68CF3DD1448B00
                                                                                                                                                                                                                          Function 00007FF660A98790 Relevance: 18.0, APIs: 2, Strings: 8, Instructions: 500COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 3764 7ff660a98790-7ff660a989c3 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a905d0 call 7ff660b3b750 3809 7ff660a989c9-7ff660a98bd6 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90510 * 3 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b1d350 call 7ff660a93680 * 7 call 7ff660a93c10 * 4 3764->3809 3810 7ff660a98bdb-7ff660a98be5 call 7ff660b0e480 3764->3810 3951 7ff660a99315-7ff660a9931c 3809->3951 3815 7ff660a98e18-7ff660a98fa0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660cd4170 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660af9c90 3810->3815 3816 7ff660a98beb-7ff660a98e13 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90510 * 3 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b1d350 call 7ff660a93680 * 7 call 7ff660a93c10 * 4 3810->3816 3876 7ff660a98fa5-7ff660a98fc9 call 7ff660a93680 * 2 3815->3876 3816->3951 3892 7ff660a99032-7ff660a99310 GetLastError FormatMessageW call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a9a250 call 7ff660a93680 call 7ff660a9ae30 * 2 call 7ff660a90510 * 2 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b1d350 call 7ff660a93680 * 7 call 7ff660a93c10 * 4 3876->3892 3893 7ff660a98fcb-7ff660a9902d call 7ff660a93680 * 3 call 7ff660a93c10 * 4 3876->3893 3892->3951 3893->3951
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Char_traitsConcurrency::details::_CriticalDecorator::getHandleLock::_ReentrantScoped_lockScoped_lock::~_TableTypetype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: .\nwjs\NW_store.exe$.\ui\.$UI StartedMain process ID:%d$creation_error=%ws$directory_switching_error$product$ui_creation_failed$ui_termination_error
                                                                                                                                                                                                                          • API String ID: 1646997740-2964731665
                                                                                                                                                                                                                          • Opcode ID: 85d66dd7dea4c7b3586083e9f12389b29026d27857ef2dc805ef1c786553ddc2
                                                                                                                                                                                                                          • Instruction ID: 565796870f008708d9069b8777d5d06201c3112666ddaa0b04fa9f7ebf76cd80
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 85d66dd7dea4c7b3586083e9f12389b29026d27857ef2dc805ef1c786553ddc2
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5342D43261DAC1E1DA719B14E8912EBB374FBC5780F401536D6CD8ABAAEF2DD645CB00
                                                                                                                                                                                                                          Function 00007FF660CD1274 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1617910340-0
                                                                                                                                                                                                                          • Opcode ID: e343539a376f2db1ff088acd6fe61eef78b7cbf5639aa4d1d11734894c44e91c
                                                                                                                                                                                                                          • Instruction ID: 67d3757ba5b4b07de206cfcde5192d9f8bee834271b27b02e9253506b55a04a3
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e343539a376f2db1ff088acd6fe61eef78b7cbf5639aa4d1d11734894c44e91c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EFC1BD36B28A82E6EB10CFA9C4916AD3771FB49BA8B104235DE1E9B7D5DF39D051C300
                                                                                                                                                                                                                          Function 00007FF660B15130 Relevance: 3.0, APIs: 2, Instructions: 14keyboardCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: keybd_event
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2665452162-0
                                                                                                                                                                                                                          • Opcode ID: a042bddbd6d60c66f133c626703260ee003b2161beff19cb918841546142377a
                                                                                                                                                                                                                          • Instruction ID: 9e6cb629514a6ba64a12f6e33e2054b1a6f6be543b8510cd9e0be25a0d90cd19
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a042bddbd6d60c66f133c626703260ee003b2161beff19cb918841546142377a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A6D0C971B111A382E7B02B617C6BFA60FB06B59BC9FA2B430C9080FB80CD2A12490750
                                                                                                                                                                                                                          Function 00007FF660AA6570 Relevance: 54.4, APIs: 15, Strings: 15, Instructions: 1912COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 360 7ff660aa6570-7ff660aa6db1 call 7ff660ca2f90 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 511 7ff660aa6f10-7ff660aa6fc9 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 360->511 512 7ff660aa6db7-7ff660aa6e38 call 7ff660a90450 call 7ff660ad8e90 call 7ff660afa800 call 7ff660a93680 360->512 546 7ff660aa6fd0-7ff660aa70d9 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 511->546 529 7ff660aa6e48-7ff660aa6e4f 512->529 530 7ff660aa6e3a-7ff660aa6e46 512->530 532 7ff660aa6e54-7ff660aa6f0b call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 529->532 530->532 532->546 567 7ff660aa70df-7ff660aa71e5 call 7ff660ab04f0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95040 call 7ff660a93c10 call 7ff660a93680 call 7ff660a93c10 546->567 568 7ff660aa7203-7ff660aa72bc call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 546->568 609 7ff660aa71ee 567->609 610 7ff660aa71e7-7ff660aa71ec 567->610 602 7ff660aa72c3-7ff660aa73cc call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 568->602 619 7ff660aa73d2-7ff660aa74d8 call 7ff660ab04f0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95040 call 7ff660a93c10 call 7ff660a93680 call 7ff660a93c10 602->619 620 7ff660aa74f6-7ff660aa75af call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 602->620 612 7ff660aa71f3-7ff660aa71fe 609->612 610->612 612->602 662 7ff660aa74e1 619->662 663 7ff660aa74da-7ff660aa74df 619->663 654 7ff660aa75b6-7ff660aa76bf call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 620->654 671 7ff660aa77e2-7ff660aa789b call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 654->671 672 7ff660aa76c5-7ff660aa77cb call 7ff660ab04f0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95040 call 7ff660a93c10 call 7ff660a93680 call 7ff660a93c10 654->672 665 7ff660aa74e6-7ff660aa74f1 662->665 663->665 665->654 705 7ff660aa78a2-7ff660aa79ab call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 671->705 714 7ff660aa77d6 672->714 715 7ff660aa77cd-7ff660aa77d4 672->715 723 7ff660aa79b1-7ff660aa7ab7 call 7ff660ab04f0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95040 call 7ff660a93c10 call 7ff660a93680 call 7ff660a93c10 705->723 724 7ff660aa7adb-7ff660aa7b94 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 705->724 717 7ff660aa77dd 714->717 715->717 717->705 765 7ff660aa7ac3 723->765 766 7ff660aa7ab9-7ff660aa7ac1 723->766 757 7ff660aa7b9b-7ff660aa7ca4 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 724->757 775 7ff660aa7dce-7ff660aa7e87 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 757->775 776 7ff660aa7caa-7ff660aa7db0 call 7ff660ab04f0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95040 call 7ff660a93c10 call 7ff660a93680 call 7ff660a93c10 757->776 768 7ff660aa7acb-7ff660aa7ad6 765->768 766->768 768->757 810 7ff660aa7e8e-7ff660aa7f97 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 775->810 817 7ff660aa7db2-7ff660aa7db7 776->817 818 7ff660aa7db9 776->818 827 7ff660aa80c1-7ff660aa817a call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 810->827 828 7ff660aa7f9d-7ff660aa80a3 call 7ff660ab04f0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95040 call 7ff660a93c10 call 7ff660a93680 call 7ff660a93c10 810->828 820 7ff660aa7dbe-7ff660aa7dc9 817->820 818->820 820->810 862 7ff660aa8181-7ff660aa828a call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 827->862 870 7ff660aa80a5-7ff660aa80aa 828->870 871 7ff660aa80ac 828->871 879 7ff660aa8290-7ff660aa8396 call 7ff660ab04f0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95040 call 7ff660a93c10 call 7ff660a93680 call 7ff660a93c10 862->879 880 7ff660aa83b4-7ff660aa846d call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 862->880 873 7ff660aa80b1-7ff660aa80bc 870->873 871->873 873->862 922 7ff660aa839f 879->922 923 7ff660aa8398-7ff660aa839d 879->923 913 7ff660aa8474-7ff660aa857d call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 880->913 931 7ff660aa8583-7ff660aa8689 call 7ff660ab04f0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95040 call 7ff660a93c10 call 7ff660a93680 call 7ff660a93c10 913->931 932 7ff660aa86ad-7ff660aa8766 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 913->932 925 7ff660aa83a4-7ff660aa83af 922->925 923->925 925->913 973 7ff660aa8695 931->973 974 7ff660aa868b-7ff660aa8693 931->974 965 7ff660aa876d-7ff660aa8876 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 932->965 983 7ff660aa89a0-7ff660aa8a59 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 965->983 984 7ff660aa887c-7ff660aa8982 call 7ff660ab04f0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95040 call 7ff660a93c10 call 7ff660a93680 call 7ff660a93c10 965->984 976 7ff660aa869d-7ff660aa86a8 973->976 974->976 976->965 1018 7ff660aa8a60-7ff660aa8b69 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 983->1018 1025 7ff660aa8984-7ff660aa8989 984->1025 1026 7ff660aa898b 984->1026 1035 7ff660aa8b6f-7ff660aa8c75 call 7ff660ab04f0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95040 call 7ff660a93c10 call 7ff660a93680 call 7ff660a93c10 1018->1035 1036 7ff660aa8c93-7ff660aa8d4c call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 1018->1036 1028 7ff660aa8990-7ff660aa899b 1025->1028 1026->1028 1028->1018 1078 7ff660aa8c7e 1035->1078 1079 7ff660aa8c77-7ff660aa8c7c 1035->1079 1070 7ff660aa8d53-7ff660aa8e5c call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 1036->1070 1087 7ff660aa8e62-7ff660aa8ee3 call 7ff660a90450 call 7ff660ad8e90 call 7ff660afa800 call 7ff660a93680 1070->1087 1088 7ff660aa8fbb-7ff660aa9074 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 1070->1088 1081 7ff660aa8c83-7ff660aa8c8e 1078->1081 1079->1081 1081->1070 1105 7ff660aa8ee5-7ff660aa8ef1 1087->1105 1106 7ff660aa8ef3-7ff660aa8efa 1087->1106 1122 7ff660aa907b-7ff660aa9184 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 1088->1122 1108 7ff660aa8eff-7ff660aa8fb6 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 1105->1108 1106->1108 1108->1122 1143 7ff660aa9290-7ff660aa9348 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 1122->1143 1144 7ff660aa918a-7ff660aa928b call 7ff660ab04f0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95040 call 7ff660a93c10 call 7ff660a93680 call 7ff660a93c10 1122->1144 1178 7ff660aa9349-7ff660aa9425 call 7ff660a93680 * 2 call 7ff660a93c10 * 13 1143->1178 1144->1178
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A910CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12310: RegCreateKeyW.ADVAPI32 ref: 00007FF660B12347
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12310: RegQueryValueExW.ADVAPI32 ref: 00007FF660B12392
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12310: RegCloseKey.ADVAPI32 ref: 00007FF660B123A1
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA6FA7
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9190
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AFA800: std::ios_base::good.LIBCPMTD ref: 00007FF660AFA9E1
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA6EE9
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA729A
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA758D
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA7879
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12310: RegCloseKey.ADVAPI32 ref: 00007FF660B123CD
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA7E65
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA8158
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA844B
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA8744
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA8A37
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA8D2A
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA8F94
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA9052
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA7B72
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A95040: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A9506B
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A95040: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A9507A
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AA9327
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: type_info::_name_internal_method$Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Close$Char_traitsCreateQueryValuestd::ios_base::good
                                                                                                                                                                                                                          • String ID: PCAppStore$PCAppStoreUpdater$auto_start_on$browser_activity$browser_search$btn_x_close$contextual_offers$hardware_collecting$link_substitution$periodical_offers$personilized_notifications$search_menu$should_auto_update$software_collecting$start_menu_on
                                                                                                                                                                                                                          • API String ID: 2434849288-4189071652
                                                                                                                                                                                                                          • Opcode ID: f6ee29e4099b68f8a37bab3f73c859f08f1169028b7f778f819ee5aee439784f
                                                                                                                                                                                                                          • Instruction ID: ffc9473c76101934aeea9846ac7f4d327ae59a9dfea56d7f56d89d4ca8f24fba
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f6ee29e4099b68f8a37bab3f73c859f08f1169028b7f778f819ee5aee439784f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F733B33261DAC1A4DA709B15E8912EBB3B4FBC5780F405136DACC8BBAADF2DD554CB40
                                                                                                                                                                                                                          Function 00007FF660A9B130 Relevance: 47.9, APIs: 13, Strings: 14, Instructions: 636registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 1212 7ff660a9b130-7ff660a9b23b call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a8d210 call 7ff660a93680 RegisterClassExW 1225 7ff660a9b24d-7ff660a9b348 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a8d210 CreateWindowExW call 7ff660a93680 1212->1225 1226 7ff660a9b23d-7ff660a9b248 call 7ff660a93680 1212->1226 1238 7ff660a9b35a-7ff660a9b5ba ShowWindow call 7ff660ca2956 call 7ff660a91200 call 7ff660aac710 call 7ff660aac1b0 call 7ff660a91200 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a95950 call 7ff660a95880 call 7ff660a93680 * 3 1225->1238 1239 7ff660a9b34a-7ff660a9b355 call 7ff660a93680 1225->1239 1232 7ff660a9c03b-7ff660a9c043 1226->1232 1278 7ff660a9b5bb-7ff660a9b5cc 1238->1278 1239->1232 1279 7ff660a9b5d2-7ff660a9b633 call 7ff660a950c0 GetForegroundWindow call 7ff660aa3200 GetWindowTextW call 7ff660aa60e0 1278->1279 1280 7ff660a9bfd8-7ff660a9c03a call 7ff660ca295c call 7ff660a93680 * 3 call 7ff660a93c10 * 2 call 7ff660a93680 1278->1280 1294 7ff660a9b662-7ff660a9b68c PeekMessageW 1279->1294 1295 7ff660a9b635-7ff660a9b64e call 7ff660aa60e0 1279->1295 1280->1232 1298 7ff660a9be21-7ff660a9be2c Sleep 1294->1298 1299 7ff660a9b692-7ff660a9b6ba TranslateMessage DispatchMessageW 1294->1299 1295->1294 1307 7ff660a9b650-7ff660a9b659 1295->1307 1302 7ff660a9be2d-7ff660a9be36 1298->1302 1303 7ff660a9b6c0-7ff660a9ba68 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90510 * 2 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660b1d350 call 7ff660a93680 * 5 call 7ff660aad500 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660aa3b30 call 7ff660a93680 * 5 1299->1303 1304 7ff660a9ba6d-7ff660a9ba78 1299->1304 1308 7ff660a9be51-7ff660a9be7c call 7ff660a8d210 OpenEventW 1302->1308 1309 7ff660a9be38 1302->1309 1310 7ff660a9be1f 1303->1310 1304->1310 1311 7ff660a9ba7e-7ff660a9be1e call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90510 * 2 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660b1d350 call 7ff660a93680 * 5 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660aa3b30 call 7ff660a93680 * 5 1304->1311 1307->1294 1317 7ff660a9b65b 1307->1317 1327 7ff660a9bfd3 1308->1327 1328 7ff660a9be82-7ff660a9be94 WaitForSingleObject 1308->1328 1312 7ff660a9be38 call 7ff660afab70 1309->1312 1310->1302 1311->1310 1318 7ff660a9be3d-7ff660a9be42 1312->1318 1317->1294 1323 7ff660a9be44 call 7ff660b15130 1318->1323 1324 7ff660a9be4a 1318->1324 1335 7ff660a9be49 1323->1335 1324->1308 1327->1278 1328->1327 1333 7ff660a9be9a-7ff660a9bfd2 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b2db90 CloseHandle call 7ff660a93c10 1328->1333 1333->1327 1335->1324
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                          • RegisterClassExW.USER32 ref: 00007FF660A9B230
                                                                                                                                                                                                                          • CreateWindowExW.USER32 ref: 00007FF660A9B31B
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsClassCreateRegisterWindowtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: ENDING_EVT_HANDLER$Local$P$PCAppStore$Windows Default Lock Screen$logoff$msg=logoff$msg=shutdown$product$product$shutdown$system_event$system_event${"app":{"menu_search":{"search_request":"", "page":"b"},"show_window": "menu_search"}}
                                                                                                                                                                                                                          • API String ID: 331722943-4236414880
                                                                                                                                                                                                                          • Opcode ID: d6b7cc22da7fded08a29c3997bda092b4185e0c6982f4232cc5aad5994020788
                                                                                                                                                                                                                          • Instruction ID: 664dfbc4b68cdcbb90706c57cf2d687da3d02dc54c3fa982a136e3b7f674f851
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d6b7cc22da7fded08a29c3997bda092b4185e0c6982f4232cc5aad5994020788
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9372D332619AC1E5EA709B14E4903EBB374FBC5780F405136D68D8ABAAEF7DD544CB40
                                                                                                                                                                                                                          Function 00007FF660C65A90 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 439COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                          • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF660C66279
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD7E60: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD7EF7
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsFac_nodeFac_node::_shared_ptrstd::_type_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: ClassGuid$CompatID$Description$DevLoader$DeviceClass$DeviceID$DeviceName$DriverDate$DriverName$DriverProviderName$DriverVersion$FriendlyName$HardWareID$InfName$Location$Manufacturer$Name$PDO$Signer$StartMode$Status$SystemCreationClassName$SystemName
                                                                                                                                                                                                                          • API String ID: 2107158585-2483722238
                                                                                                                                                                                                                          • Opcode ID: eb293c1746a966074f26d9537311439fee5a1a86e8bb700df527b3a9aba83937
                                                                                                                                                                                                                          • Instruction ID: 22f9247d2b2b76c02fab7bed9b16ccfb67e5bd865cb5689d6b2518280f4a267c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: eb293c1746a966074f26d9537311439fee5a1a86e8bb700df527b3a9aba83937
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D032EB3661DAC2F1DA709B14E4912EEB374FBC5384F805536D68DCAB6ADE2DD648CB00
                                                                                                                                                                                                                          Function 00007FF660C42C40 Relevance: 35.9, APIs: 10, Strings: 10, Instructions: 897COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 1664 7ff660c42c40-7ff660c43138 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a913f0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12420 call 7ff660a8d210 call 7ff660ca9110 1751 7ff660c4314b-7ff660c43152 1664->1751 1752 7ff660c4313a-7ff660c43149 1664->1752 1753 7ff660c4315a-7ff660c4334d call 7ff660a910b0 call 7ff660ad9220 call 7ff660a9a530 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 * 2 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12420 call 7ff660a8d210 call 7ff660ca9110 1751->1753 1752->1753 1786 7ff660c43359 1753->1786 1787 7ff660c4334f-7ff660c43357 1753->1787 1788 7ff660c43361-7ff660c434a5 call 7ff660a93680 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12420 call 7ff660a8d210 call 7ff660ca9110 1786->1788 1787->1788 1805 7ff660c434a7-7ff660c434af 1788->1805 1806 7ff660c434b1 1788->1806 1807 7ff660c434b9-7ff660c435fd call 7ff660a93680 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12420 call 7ff660a8d210 call 7ff660ca9110 1805->1807 1806->1807 1824 7ff660c43609 1807->1824 1825 7ff660c435ff-7ff660c43607 1807->1825 1826 7ff660c43611-7ff660c4362c call 7ff660a93680 1824->1826 1825->1826 1829 7ff660c4363f-7ff660c43646 1826->1829 1830 7ff660c4362e-7ff660c4363d 1826->1830 1831 7ff660c4364e-7ff660c4370a call 7ff660a910b0 call 7ff660ad9220 call 7ff660a9a530 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 1829->1831 1830->1831 1848 7ff660c4371d-7ff660c43724 1831->1848 1849 7ff660c4370c-7ff660c4371b 1831->1849 1850 7ff660c4372c-7ff660c437e8 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a9a530 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 1848->1850 1849->1850 1867 7ff660c437fb-7ff660c43802 1850->1867 1868 7ff660c437ea-7ff660c437f9 1850->1868 1869 7ff660c4380a-7ff660c438cc call 7ff660a910b0 call 7ff660ad9220 call 7ff660a9a530 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 1867->1869 1868->1869 1886 7ff660c43bf9-7ff660c43d6e call 7ff660a90c10 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 call 7ff660a954e0 call 7ff660a952b0 call 7ff660ab0350 call 7ff660aaa8b0 1869->1886 1887 7ff660c438d2-7ff660c43aef call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b12310 1869->1887 1928 7ff660c43e05-7ff660c43e16 call 7ff660aaa8b0 1886->1928 1929 7ff660c43d74-7ff660c43d9d call 7ff660aaa8b0 1886->1929 1966 7ff660c43af8 1887->1966 1967 7ff660c43af1-7ff660c43af6 1887->1967 1937 7ff660c43e1c-7ff660c43f00 call 7ff660a8bc20 call 7ff660aa5ce0 call 7ff660aa3140 call 7ff660a95830 call 7ff660a897a0 call 7ff660a95040 call 7ff660a93c10 1928->1937 1938 7ff660c43f01-7ff660c440c5 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a9a530 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a950c0 call 7ff660a93c10 call 7ff660a93680 call 7ff660a905d0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660c415d0 * 2 call 7ff660c415a0 call 7ff660c415d0 call 7ff660a89ef0 call 7ff660c415d0 call 7ff660a93680 1928->1938 1939 7ff660c43dac-7ff660c43db9 1929->1939 1937->1938 2030 7ff660c440c7-7ff660c440cf 1938->2030 2031 7ff660c440d1 1938->2031 1943 7ff660c43dbb-7ff660c43dfe call 7ff660aa3140 call 7ff660aa9be0 1939->1943 1944 7ff660c43e00 1939->1944 1943->1939 1944->1938 1970 7ff660c43afd-7ff660c43b04 1966->1970 1967->1970 1973 7ff660c43b17-7ff660c43b1e 1970->1973 1974 7ff660c43b06-7ff660c43b15 1970->1974 1977 7ff660c43b26-7ff660c43bf8 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a956a0 call 7ff660a95160 call 7ff660a93c10 call 7ff660a93680 call 7ff660a93c10 * 2 1973->1977 1974->1977 1977->1886 2032 7ff660c440d9-7ff660c44202 call 7ff660b326a0 call 7ff660a90450 call 7ff660b2db90 call 7ff660a93680 call 7ff660a93c10 call 7ff660a97240 call 7ff660a93d60 call 7ff660a93c10 * 7 2030->2032 2031->2032
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A910CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12420: RegCreateKeyW.ADVAPI32 ref: 00007FF660B12470
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12420: strrchr.LIBCMTD ref: 00007FF660B12487
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12420: RegQueryValueExW.ADVAPI32 ref: 00007FF660B124D3
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12420: RegCloseKey.ADVAPI32 ref: 00007FF660B124ED
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660C431EF
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660C436E3
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660C437C1
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660C43BBB
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660C4389F
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12310: RegCreateKeyW.ADVAPI32 ref: 00007FF660B12347
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12310: RegQueryValueExW.ADVAPI32 ref: 00007FF660B12392
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12310: RegCloseKey.ADVAPI32 ref: 00007FF660B123A1
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660C44039
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660C44048
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660C44065
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660C44074
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660C44090
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: type_info::_name_internal_method$Decorator::getTableType$Concurrency::details::EmptyQueue::StructuredWork$CloseCreateQueryValue$Char_traitsshared_ptrstrrchr
                                                                                                                                                                                                                          • String ID: ColorPrevalence$ColorizationColor$EnableTransparency$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Software\Microsoft\Windows\CurrentVersion\Themes\Personalize$Software\Microsoft\Windows\DWM$SystemUsesLightTheme$TaskbarAl$theme_parameter${"app" : {
                                                                                                                                                                                                                          • API String ID: 3722789660-4154301006
                                                                                                                                                                                                                          • Opcode ID: 7f1a1e4a8968a2112be82242c4f6d7417b05539fde8c688b527de53e6d46c90b
                                                                                                                                                                                                                          • Instruction ID: 458a42e001e2e33a85b9aed5262a64a8e845734c08761389b82c78b1a7a679fc
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7f1a1e4a8968a2112be82242c4f6d7417b05539fde8c688b527de53e6d46c90b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3DB2A332619AC1E5DAB09B15E4902EBB3B4FBC4780F405136DA8D87BAAEF3DD554CB40
                                                                                                                                                                                                                          Function 00007FF660A9C290 Relevance: 34.6, APIs: 6, Strings: 13, Instructions: 1383COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 2061 7ff660a9c290-7ff660a9c718 call 7ff660ca2f90 call 7ff660aaa0d0 call 7ff660aad500 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a905d0 call 7ff660afa6b0 call 7ff660a8d210 * 2 call 7ff660a9a250 call 7ff660a93680 call 7ff660a90510 * 2 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660b1ca30 call 7ff660a93680 * 4 call 7ff660a88ad0 call 7ff660aa48d0 call 7ff660a98790 2142 7ff660a9c71e-7ff660a9c804 call 7ff660a90450 call 7ff660ad8e90 call 7ff660aa3b30 call 7ff660a93680 call 7ff660a94e10 call 7ff660a93680 * 2 call 7ff660a93c10 call 7ff660a93680 * 5 2061->2142 2143 7ff660a9c809-7ff660a9c818 call 7ff660b12f10 call 7ff660aab220 2061->2143 2231 7ff660a9e29b-7ff660a9e2a2 2142->2231 2152 7ff660a9c819-7ff660a9c82c call 7ff660b2e340 2143->2152 2159 7ff660a9ca43-7ff660a9ca6e call 7ff660aacdd0 call 7ff660aa97e0 call 7ff660aab220 2152->2159 2160 7ff660a9c832-7ff660a9c843 2152->2160 2181 7ff660a9ca73-7ff660a9ca86 call 7ff660b2d2d0 2159->2181 2160->2159 2163 7ff660a9c849-7ff660a9c891 call 7ff660aab220 call 7ff660a8a520 call 7ff660a89a20 call 7ff660aa4400 2160->2163 2188 7ff660a9ca11-7ff660a9ca38 call 7ff660b2d390 call 7ff660a97d40 call 7ff660a8fed0 2163->2188 2189 7ff660a9c897-7ff660a9ca0c call 7ff660a90450 call 7ff660ad8e90 call 7ff660aa3340 call 7ff660a93680 call 7ff660b12f10 call 7ff660a90450 call 7ff660ad8e90 call 7ff660aa3b30 call 7ff660a93680 call 7ff660aabd30 call 7ff660a94e10 call 7ff660a93680 * 2 call 7ff660a93c10 call 7ff660a93680 * 5 2163->2189 2191 7ff660a9cc8b-7ff660a9cf0d call 7ff660a902f0 call 7ff660a893b0 call 7ff660c6f450 call 7ff660c6f480 call 7ff660a90510 * 3 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a90450 call 7ff660ad8e90 call 7ff660b1ca30 call 7ff660a93680 * 5 call 7ff660a90450 call 7ff660ad8e90 call 7ff660b2db90 2181->2191 2192 7ff660a9ca8c-7ff660a9ca9d 2181->2192 2219 7ff660a9ca3d-7ff660a9ca3e 2188->2219 2189->2231 2332 7ff660a9cf0f-7ff660a9cf78 call 7ff660a94e10 call 7ff660a93680 * 2 call 7ff660a93c10 call 7ff660a93680 * 5 2191->2332 2333 7ff660a9cf7d-7ff660a9d513 call 7ff660a8d210 call 7ff660ac01e0 call 7ff660a8bc20 call 7ff660b4a2b0 call 7ff660a94730 call 7ff660a8d210 call 7ff660ac1a90 call 7ff660a8bc20 call 7ff660b4a0c0 call 7ff660a94730 call 7ff660a8d210 * 2 call 7ff660b2a070 call 7ff660a8bc20 call 7ff660b4a0c0 call 7ff660a94730 call 7ff660a8d210 call 7ff660b2fd90 call 7ff660a8bc20 call 7ff660b4a2b0 call 7ff660a94730 call 7ff660a8d210 * 2 call 7ff660b338c0 call 7ff660a8bc20 call 7ff660b4a160 call 7ff660a94730 call 7ff660a8d210 * 2 call 7ff660b38be0 call 7ff660a8bc20 call 7ff660b4a2b0 call 7ff660a94730 call 7ff660a8d210 call 7ff660b39bc0 call 7ff660a8bc20 call 7ff660b4a2b0 call 7ff660a94730 call 7ff660a8d210 call 7ff660b3ff90 call 7ff660a8bc20 call 7ff660b4a2b0 call 7ff660a94730 call 7ff660a8d210 * 2 call 7ff660b4ea80 call 7ff660a8bc20 call 7ff660b4a160 call 7ff660a94730 2191->2333 2192->2191 2197 7ff660a9caa3-7ff660a9caeb call 7ff660aab220 call 7ff660a8a520 call 7ff660a89a20 call 7ff660aa4400 2192->2197 2236 7ff660a9caf1-7ff660a9cc66 call 7ff660a90450 call 7ff660ad8e90 call 7ff660aa3340 call 7ff660a93680 call 7ff660b12f10 call 7ff660a90450 call 7ff660ad8e90 call 7ff660aa3b30 call 7ff660a93680 call 7ff660aabd30 call 7ff660a94e10 call 7ff660a93680 * 2 call 7ff660a93c10 call 7ff660a93680 * 5 2197->2236 2237 7ff660a9cc6b-7ff660a9cc86 call 7ff660a97d40 call 7ff660a8fed0 2197->2237 2219->2152 2236->2231 2237->2181 2332->2231 2457 7ff660a9d515-7ff660a9d523 call 7ff660aa9dd0 2333->2457 2458 7ff660a9d528-7ff660a9d574 call 7ff660a8d210 * 2 call 7ff660c3f510 2333->2458 2463 7ff660a9d5ca-7ff660a9d96d call 7ff660a8d210 * 2 call 7ff660c3cd30 call 7ff660a8bc20 call 7ff660b4a0c0 call 7ff660a94730 call 7ff660a8d210 * 2 call 7ff660c44210 call 7ff660a8bc20 call 7ff660b4a160 call 7ff660a94730 call 7ff660a8d210 * 2 call 7ff660c52560 call 7ff660a8bc20 call 7ff660b4a2b0 call 7ff660a94730 call 7ff660a8d210 call 7ff660c55180 call 7ff660a8bc20 call 7ff660b4a2b0 call 7ff660a94730 call 7ff660a8d210 call 7ff660b4ab80 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660c53e60 call 7ff660a88ad0 call 7ff660aa48d0 call 7ff660a88ad0 2457->2463 2470 7ff660a9d579-7ff660a9d5c9 call 7ff660a8bc20 call 7ff660b4a0c0 call 7ff660a94730 2458->2470 2541 7ff660a9d972-7ff660a9da53 call 7ff660aa48d0 call 7ff660a910b0 call 7ff660ad9220 call 7ff660b2db90 WaitForSingleObject call 7ff660c6f4d0 2463->2541 2470->2463 2552 7ff660a9e1a5-7ff660a9e1f8 call 7ff660b2d420 call 7ff660b12f10 call 7ff660aa62c0 ResetEvent 2541->2552 2553 7ff660a9da59-7ff660a9da75 WaitForSingleObject 2541->2553 2567 7ff660a9e208-7ff660a9e29a call 7ff660a94e10 * 2 call 7ff660a93c10 call 7ff660a94e10 call 7ff660a93680 * 2 call 7ff660a93c10 call 7ff660a93680 * 5 2552->2567 2568 7ff660a9e1fa-7ff660a9e207 call 7ff660aabd30 2552->2568 2554 7ff660a9e180-7ff660a9e1a4 CloseHandle * 2 2553->2554 2555 7ff660a9da7b-7ff660a9dd19 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a90510 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a90450 call 7ff660ad8e90 call 7ff660b1cb80 call 7ff660b3b750 2553->2555 2554->2552 2622 7ff660a9dd1f-7ff660a9df3b call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a90510 * 3 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a90450 call 7ff660ad8e90 call 7ff660b1d350 call 7ff660a93680 * 5 call 7ff660a93c10 2555->2622 2623 7ff660a9df40-7ff660a9df45 2555->2623 2567->2231 2568->2567 2625 7ff660a9e167-7ff660a9e17f call 7ff660a93c10 call 7ff660a93680 2622->2625 2623->2625 2626 7ff660a9df4b-7ff660a9e166 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a8d210 call 7ff660a911a0 call 7ff660a93680 call 7ff660a90510 * 3 call 7ff660a910b0 call 7ff660ad9220 call 7ff660a90450 call 7ff660ad8e90 call 7ff660b1d350 call 7ff660a93680 * 5 call 7ff660a93c10 2623->2626 2625->2554 2626->2625
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Cpp_errorDecorator::getNameTableThrow_Typestd::_$Char_traitsCloseDefaultFileLanguageLocaleModuleOpenThrd_detachUserValuetype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: prnt=%ws&sys_lang=%ws$product$product$started$ui_closing_failed$ui_closing_timeout$ui_creation_error$ui_not_found$waiting_for_UI_connection$waiting_for_windows_creation$windows_created${"app" : {"show_window":"main"}}${"app": {"init": {"engineInit": true}}}
                                                                                                                                                                                                                          • API String ID: 2904651881-622979156
                                                                                                                                                                                                                          • Opcode ID: 1508d5b1e3f5a8af9e0f688e9bf640542cbe528146bce742b1b7f60b30cf2098
                                                                                                                                                                                                                          • Instruction ID: 8525ed349becba954850d6cbd8cb590203fc88f6375b2baa5e64849ab5164cd2
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1508d5b1e3f5a8af9e0f688e9bf640542cbe528146bce742b1b7f60b30cf2098
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 91F2F73261DAC1E1DA70AB14E4913EBA3B4FBC5780F401536D6CD8BBAAEE2DD554CB40
                                                                                                                                                                                                                          Function 00007FF660C44210 Relevance: 28.5, APIs: 7, Strings: 9, Instructions: 477COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 2810 7ff660c44210-7ff660c44236 2811 7ff660c44238-7ff660c44245 2810->2811 2812 7ff660c44247-7ff660c44267 call 7ff660b28880 2810->2812 2811->2812 2813 7ff660c4426c-7ff660c44507 call 7ff660c42c40 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a8d210 CreateEventW call 7ff660a93680 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 2811->2813 2817 7ff660c44e0b-7ff660c44e12 2812->2817 2859 7ff660c4450d-7ff660c446e3 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a902f0 call 7ff660c3fff0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660c40210 call 7ff660a93680 * 3 2813->2859 2860 7ff660c446e4-7ff660c44cf9 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a902f0 call 7ff660c40030 call 7ff660a90450 call 7ff660ad8e90 call 7ff660c40210 call 7ff660a93680 * 2 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a902f0 call 7ff660c40070 call 7ff660a90450 call 7ff660ad8e90 call 7ff660c40210 call 7ff660a93680 * 2 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a902f0 call 7ff660c3ffb0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660c40210 call 7ff660a93680 * 2 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a902f0 call 7ff660c3ff70 call 7ff660a90450 call 7ff660ad8e90 call 7ff660c40210 2813->2860 2859->2860 2952 7ff660c44cfe-7ff660c44e03 call 7ff660a93680 * 2 call 7ff660ab12e0 call 7ff660a902f0 call 7ff660c3feb0 call 7ff660b287a0 call 7ff660a94730 call 7ff660a93680 * 8 2860->2952 2952->2817
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CreateEventW.KERNEL32 ref: 00007FF660C44324
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                          • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660C445E7
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9190
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C40210: CreateEventW.KERNEL32 ref: 00007FF660C40238
                                                                                                                                                                                                                          • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660C4477F
                                                                                                                                                                                                                          • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660C4490F
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                          • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660C44A9C
                                                                                                                                                                                                                          • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660C44C29
                                                                                                                                                                                                                          • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660C44D50
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C3FEB0: shared_ptr.LIBCMTD ref: 00007FF660C3FF23
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::_SchedulerScheduler::_$shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$CreateEvent$Char_traitstype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: ClosingEvent$ColorPrevalence$ColorizationColor$EnableTransparency$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Software\Microsoft\Windows\CurrentVersion\Themes\Personalize$Software\Microsoft\Windows\DWM$SystemUsesLightTheme$TaskbarAl
                                                                                                                                                                                                                          • API String ID: 2878102572-2470191940
                                                                                                                                                                                                                          • Opcode ID: 7807da375b36c00595324c79739ff77650c968c057f50ed72c3c66ffa33fbc52
                                                                                                                                                                                                                          • Instruction ID: 7aade85a34fb7d6428271e34f94e639a0f2f805fe007ecbcf1a8a092677bb4e0
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7807da375b36c00595324c79739ff77650c968c057f50ed72c3c66ffa33fbc52
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3C529E36619BC1A5DAB19B15E4903DBB3B8FBC9780F400136DA8C87B6AEF78D554CB40
                                                                                                                                                                                                                          Function 00007FF660B3C300 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 111memoryCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Decorator::getTableType$QueryValue$Globalwsprintf$AllocFree
                                                                                                                                                                                                                          • String ID: \StringFileInfo\%04x%04x\FileDescription$\StringFileInfo\%04x%04x\ProductVersion$\VarFileInfo\Translation
                                                                                                                                                                                                                          • API String ID: 3623593157-227869778
                                                                                                                                                                                                                          • Opcode ID: afe8b2dcc620858387f586322b9613184bd3ab54d5df8500ecc911c2893dbe4c
                                                                                                                                                                                                                          • Instruction ID: d3c9fab329fa8e1fbeed81f66e165ebbb765929b30a3950702f2bb28d4bf7595
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: afe8b2dcc620858387f586322b9613184bd3ab54d5df8500ecc911c2893dbe4c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CF516172618A86E2DB60DB15E0517BAB7B4FBC8784F405132EA8ECB769DE3CD544CB00
                                                                                                                                                                                                                          Function 00007FF660C60140 Relevance: 23.4, APIs: 3, Strings: 10, Instructions: 662COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 3014 7ff660c60140-7ff660c603b3 call 7ff660a90f30 call 7ff660ad9aa0 call 7ff660a90f30 call 7ff660ad9aa0 call 7ff660a90f30 call 7ff660ad9aa0 call 7ff660a90f30 call 7ff660ad9aa0 call 7ff660a90f30 call 7ff660ad9aa0 call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660c5caf0 call 7ff660b188f0 call 7ff660ab9140 * 2 call 7ff660a93be0 call 7ff660a91680 call 7ff660c67830 3054 7ff660c603b8-7ff660c604a2 call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660b188f0 call 7ff660b0bf80 call 7ff660ab9140 * 2 call 7ff660a93be0 3014->3054 3071 7ff660c604a8-7ff660c6058f call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660b188f0 call 7ff660c67d20 call 7ff660ab9140 * 2 call 7ff660a93be0 3054->3071 3072 7ff660c60590-7ff660c60679 call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660b188f0 call 7ff660b0bf80 call 7ff660ab9140 * 2 call 7ff660a93be0 3054->3072 3071->3072 3105 7ff660c60767-7ff660c607b2 call 7ff660aa2900 call 7ff660aa2950 3072->3105 3106 7ff660c6067f-7ff660c60766 call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660b188f0 call 7ff660c67d20 call 7ff660ab9140 * 2 call 7ff660a93be0 3072->3106 3118 7ff660c607b8-7ff660c608a8 call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660b188f0 call 7ff660b0bf80 call 7ff660ab9140 * 2 call 7ff660a93be0 3105->3118 3119 7ff660c60a73-7ff660c60a82 call 7ff660abf380 3105->3119 3106->3105 3177 7ff660c60a6e 3118->3177 3178 7ff660c608ae-7ff660c60a6d call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660b188f0 call 7ff660c67270 call 7ff660ab9140 * 2 call 7ff660a93be0 call 7ff660abf420 call 7ff660abb5c0 call 7ff660abf420 call 7ff660c5b360 call 7ff660c5c430 3118->3178 3126 7ff660c6109c-7ff660c61112 call 7ff660c5c450 call 7ff660c5c430 call 7ff660ab9140 call 7ff660a93be0 * 5 3119->3126 3127 7ff660c60a88-7ff660c6109b call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660abf420 call 7ff660abb5c0 call 7ff660c5b4e0 call 7ff660af3390 call 7ff660abf420 call 7ff660abb5c0 call 7ff660c5b760 call 7ff660abb5c0 call 7ff660c5b120 call 7ff660c67e90 call 7ff660a905d0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660c55480 call 7ff660abc650 call 7ff660aa31e0 call 7ff660a904b0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a8d210 call 7ff660a9a250 call 7ff660a93680 * 2 call 7ff660a93be0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660b1ca30 call 7ff660a93680 * 4 call 7ff660ab91f0 call 7ff660a93680 * 6 3119->3127 3127->3126 3177->3119 3178->3177
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90F30: char_traits.LIBCPMTD ref: 00007FF660A90F5D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9B51
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9B8C
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: shared_ptr.LIBCMTD ref: 00007FF660AD9BC8
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A90EAD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9580: shared_ptr.LIBCMTD ref: 00007FF660AD95B3
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9580: shared_ptr.LIBCMTD ref: 00007FF660AD963C
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B188F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B18930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B188F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF660B18982
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B188F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B189B2
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B188F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF660B18A27
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C67830: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660C67944
                                                                                                                                                                                                                          • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF660C60779
                                                                                                                                                                                                                          • HandleT.LIBCPMTD ref: 00007FF660C60788
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Is_slash_oper::operatorstd::_$Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_char_traitstype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: /p.gif$Default$Extensions$Guest Profile$Microsoft\Edge\User Data$Secure Preferences$data=%ws$ev.pcapp.store$ext_edge$pcdetails
                                                                                                                                                                                                                          • API String ID: 9541410-4110900778
                                                                                                                                                                                                                          • Opcode ID: cd880266fa3ace2700625b09567d9071faeaf32e91f68645fb4afdb0aa0d1f10
                                                                                                                                                                                                                          • Instruction ID: 2a6acf189d8e9c37a85119f48127b877baa62b893b98ad87198dd71bdcec9436
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cd880266fa3ace2700625b09567d9071faeaf32e91f68645fb4afdb0aa0d1f10
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F782C33260EAC6E5DAB09B15E4902EFB374EBC5780F405132D6CD87BAAEF29D545CB40
                                                                                                                                                                                                                          Function 00007FF660C5F160 Relevance: 23.4, APIs: 3, Strings: 10, Instructions: 661COMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 3298 7ff660c5f160-7ff660c5f4c2 call 7ff660a90f30 call 7ff660ad9aa0 call 7ff660a90f30 call 7ff660ad9aa0 call 7ff660a90f30 call 7ff660ad9aa0 call 7ff660a90f30 call 7ff660ad9aa0 call 7ff660a90f30 call 7ff660ad9aa0 call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660c5caf0 call 7ff660b188f0 call 7ff660ab9140 * 2 call 7ff660a93be0 call 7ff660a91680 call 7ff660c67830 call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660b188f0 call 7ff660b0bf80 call 7ff660ab9140 * 2 call 7ff660a93be0 3355 7ff660c5f4c8-7ff660c5f5af call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660b188f0 call 7ff660c67d20 call 7ff660ab9140 * 2 call 7ff660a93be0 3298->3355 3356 7ff660c5f5b0-7ff660c5f699 call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660b188f0 call 7ff660b0bf80 call 7ff660ab9140 * 2 call 7ff660a93be0 3298->3356 3355->3356 3389 7ff660c5f787-7ff660c5f7d2 call 7ff660aa2900 call 7ff660aa2950 3356->3389 3390 7ff660c5f69f-7ff660c5f786 call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660b188f0 call 7ff660c67d20 call 7ff660ab9140 * 2 call 7ff660a93be0 3356->3390 3402 7ff660c5f7d8-7ff660c5f8c8 call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660b188f0 call 7ff660b0bf80 call 7ff660ab9140 * 2 call 7ff660a93be0 3389->3402 3403 7ff660c5fa93-7ff660c5faa2 call 7ff660abf380 3389->3403 3390->3389 3462 7ff660c5fa8e 3402->3462 3463 7ff660c5f8ce-7ff660c5f983 call 7ff660a90e90 call 7ff660ad9580 call 7ff660b1f8f0 call 7ff660b188f0 call 7ff660c67270 3402->3463 3412 7ff660c600bc-7ff660c60132 call 7ff660c5c450 call 7ff660c5c430 call 7ff660ab9140 call 7ff660a93be0 * 5 3403->3412 3413 7ff660c5faa8-7ff660c600bb call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660abf420 call 7ff660abb5c0 call 7ff660c5b4e0 call 7ff660af3390 call 7ff660abf420 call 7ff660abb5c0 call 7ff660c5b760 call 7ff660abb5c0 call 7ff660c5b120 call 7ff660c67e90 call 7ff660a905d0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660c55480 call 7ff660abc650 call 7ff660aa31e0 call 7ff660a904b0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a8d210 call 7ff660a9a250 call 7ff660a93680 * 2 call 7ff660a93be0 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660b1ca30 call 7ff660a93680 * 4 call 7ff660ab91f0 call 7ff660a93680 * 6 3403->3413 3413->3412 3462->3403 3485 7ff660c5f988-7ff660c5fa8d call 7ff660ab9140 * 2 call 7ff660a93be0 call 7ff660abf420 call 7ff660abb5c0 call 7ff660abf420 call 7ff660c5b360 call 7ff660c5c430 3463->3485 3485->3462
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90F30: char_traits.LIBCPMTD ref: 00007FF660A90F5D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9B51
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9B8C
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: shared_ptr.LIBCMTD ref: 00007FF660AD9BC8
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A90EAD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9580: shared_ptr.LIBCMTD ref: 00007FF660AD95B3
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9580: shared_ptr.LIBCMTD ref: 00007FF660AD963C
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B188F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B18930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B188F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF660B18982
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B188F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B189B2
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B188F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF660B18A27
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C67830: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660C67944
                                                                                                                                                                                                                          • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF660C5F799
                                                                                                                                                                                                                          • HandleT.LIBCPMTD ref: 00007FF660C5F7A8
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Is_slash_oper::operatorstd::_$Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_char_traitstype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: /p.gif$Default$Extensions$Google\Chrome\User Data$Guest Profile$Secure Preferences$data=%ws$ev.pcapp.store$ext_chrome$pcdetails
                                                                                                                                                                                                                          • API String ID: 9541410-2486191938
                                                                                                                                                                                                                          • Opcode ID: 73086fd2165a8b3c859d53943514ab0957c8b9f56e4a06f020a45e2f3df26598
                                                                                                                                                                                                                          • Instruction ID: 5ae99e49bae8a031134deb537de42dd68dc615670fa5b0cb0c35907a422fe29e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 73086fd2165a8b3c859d53943514ab0957c8b9f56e4a06f020a45e2f3df26598
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B082D33260EAC6E5DAB09B15E4902EFB374EBC5780F405132D6CD87BAAEF29D545CB40
                                                                                                                                                                                                                          Function 00007FF660ADBE70 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 264timeCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 3582 7ff660adbe70-7ff660adbeab 3583 7ff660adbeb1-7ff660adbeca call 7ff660ac6b60 3582->3583 3584 7ff660adbf50-7ff660adbf52 3582->3584 3588 7ff660adbee1-7ff660adbeed 3583->3588 3589 7ff660adbecc-7ff660adbedf 3583->3589 3585 7ff660adc4c9-7ff660adc4d0 3584->3585 3590 7ff660adbef2-7ff660adbf5d call 7ff660a8d210 WinHttpConnect 3588->3590 3589->3590 3594 7ff660adbf63-7ff660adc2bb call 7ff660a905d0 GetTickCount64 call 7ff660ac6b60 3590->3594 3595 7ff660adc449-7ff660adc44b 3590->3595 3600 7ff660adc2dd-7ff660adc2f1 call 7ff660a8d210 3594->3600 3601 7ff660adc2bd-7ff660adc2db call 7ff660a8d210 3594->3601 3595->3585 3606 7ff660adc2f9-7ff660adc3cf call 7ff660a8d210 call 7ff660a9a250 call 7ff660a8d210 WinHttpOpenRequest 3600->3606 3601->3606 3613 7ff660adc3d1-7ff660adc3f7 WinHttpSetTimeouts 3606->3613 3614 7ff660adc43c-7ff660adc453 call 7ff660a93680 3606->3614 3613->3614 3616 7ff660adc3f9-7ff660adc3ff 3613->3616 3623 7ff660adc485-7ff660adc48a 3614->3623 3624 7ff660adc455-7ff660adc481 WinHttpSendRequest 3614->3624 3618 7ff660adc401-7ff660adc40c WinHttpCloseHandle 3616->3618 3619 7ff660adc40d-7ff660adc413 3616->3619 3618->3619 3621 7ff660adc415-7ff660adc420 WinHttpCloseHandle 3619->3621 3622 7ff660adc421-7ff660adc437 call 7ff660a93680 3619->3622 3621->3622 3622->3585 3626 7ff660adc49d-7ff660adc4a3 3623->3626 3627 7ff660adc48c-7ff660adc499 WinHttpReceiveResponse 3623->3627 3624->3623 3629 7ff660adc4a5-7ff660adc4b0 WinHttpCloseHandle 3626->3629 3630 7ff660adc4b1-7ff660adc4b7 3626->3630 3627->3626 3629->3630 3631 7ff660adc4c5 3630->3631 3632 7ff660adc4b9-7ff660adc4c4 WinHttpCloseHandle 3630->3632 3631->3585 3632->3631
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Http$CloseHandle$Requeststd::ios_base::good$ConnectCount64OpenReceiveResponseSendTickTimeouts
                                                                                                                                                                                                                          • String ID: GET
                                                                                                                                                                                                                          • API String ID: 2571818228-1805413626
                                                                                                                                                                                                                          • Opcode ID: 97b424a5f142e7ff86e6a48141ea42eb383f2602b031ef10f70d93426b751497
                                                                                                                                                                                                                          • Instruction ID: 0148d44872de3bc1c17f157b8e4ecb52b034e50c7244a861afc1c6241f7fa7d3
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 97b424a5f142e7ff86e6a48141ea42eb383f2602b031ef10f70d93426b751497
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6EF15D36609FC5D5DAB08B06F8943AAB3A4F788B90F504526DACD87B69DF7CD094CB00
                                                                                                                                                                                                                          Function 00007FF660A9E340 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 302windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                          control_flow_graph 3633 7ff660a9e340-7ff660a9e36a 3634 7ff660a9e395-7ff660a9e39d 3633->3634 3635 7ff660a9e36c-7ff660a9e371 3633->3635 3638 7ff660a9e3a3-7ff660a9e3ab 3634->3638 3639 7ff660a9e425-7ff660a9e42e 3634->3639 3636 7ff660a9e420 3635->3636 3637 7ff660a9e377-7ff660a9e37c 3635->3637 3640 7ff660a9e9ec-7ff660a9ea0b DefWindowProcW 3636->3640 3643 7ff660a9e37e-7ff660a9e383 3637->3643 3644 7ff660a9e3b6 3637->3644 3645 7ff660a9e3b1 3638->3645 3646 7ff660a9e99b-7ff660a9e9a4 3638->3646 3641 7ff660a9e434-7ff660a9e6d8 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90510 * 2 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660b1d350 call 7ff660a93680 * 8 3639->3641 3642 7ff660a9e6dd-7ff660a9e6e6 3639->3642 3654 7ff660a9ea11-7ff660a9ea18 3640->3654 3647 7ff660a9e999 3641->3647 3642->3647 3648 7ff660a9e6ec-7ff660a9e998 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a911a0 call 7ff660ad98a0 call 7ff660a90510 * 2 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660a90450 call 7ff660ad8e90 call 7ff660b1d350 call 7ff660a93680 * 8 3642->3648 3652 7ff660a9e389-7ff660a9e38e 3643->3652 3653 7ff660a9e9ba-7ff660a9e9c3 PostQuitMessage 3643->3653 3644->3640 3655 7ff660a9e9c5-7ff660a9e9ea DefWindowProcW 3645->3655 3650 7ff660a9e9a6-7ff660a9e9af 3646->3650 3651 7ff660a9e9b8 3646->3651 3647->3640 3648->3647 3650->3651 3658 7ff660a9e9b1 3650->3658 3651->3640 3659 7ff660a9e390 3652->3659 3660 7ff660a9e3bb-7ff660a9e3d1 3652->3660 3653->3640 3655->3640 3655->3654 3658->3651 3659->3655 3663 7ff660a9e3ef-7ff660a9e3f8 3660->3663 3664 7ff660a9e3d3-7ff660a9e3ed PostMessageW 3660->3664 3665 7ff660a9e414-7ff660a9e416 3663->3665 3666 7ff660a9e3fa-7ff660a9e413 PostMessageW 3663->3666 3664->3665 3665->3654 3666->3665
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MessagePostProcWindow$Quit
                                                                                                                                                                                                                          • String ID: msg=resume_suspend$msg=suspend$product$product$system_event$system_event
                                                                                                                                                                                                                          • API String ID: 3552470998-2520652036
                                                                                                                                                                                                                          • Opcode ID: 27947475573f83966e282697e3c0dd6a6a3718365272a7e70e730e185c8f9924
                                                                                                                                                                                                                          • Instruction ID: fe33cdf8220443126e00283c53eea87a6d7c16dc7e10db444f4cfec9ecaa8653
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 27947475573f83966e282697e3c0dd6a6a3718365272a7e70e730e185c8f9924
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0FF1D73261DAC6E1E6709B14E4812EAB374FBC9380F401136D6CD8AB6ADF7DD544CB40
                                                                                                                                                                                                                          Function 00007FF660A997D0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 439COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ChildEnumWindows$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsClassNameTextWindowshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: =====> %ws FOUND <=====$Shell_TrayWnd$Start$TrayButton$TrayDummySearchControl
                                                                                                                                                                                                                          • API String ID: 1535316472-2840285642
                                                                                                                                                                                                                          • Opcode ID: 7fe0df0d68581543fdde8778ed7c649569f840863e721b030b028d09b828e4df
                                                                                                                                                                                                                          • Instruction ID: e66553aa957d79b5d6d7be531f06174626c03f9114873092f05b7c438ade325e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7fe0df0d68581543fdde8778ed7c649569f840863e721b030b028d09b828e4df
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4732B53361DAC1E5EA709B55E4913EAB3B4EBC4780F400536D6CD8ABAAEF2DD544CB40
                                                                                                                                                                                                                          Function 00007FF660AAA0D0 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 273COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AA62C0: RegOpenKeyExW.ADVAPI32 ref: 00007FF660AA643E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AA62C0: RegQueryValueExW.ADVAPI32 ref: 00007FF660AA64F7
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660AAA211
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660AAA290
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660AAA41F
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660AAA31A
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Decorator::getTableType$shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsOpenQueryValuetype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: RESTART$RUNNING$Unknown+state=%d$close_state=%ws$invalid_app_close$product
                                                                                                                                                                                                                          • API String ID: 3445494136-3736349495
                                                                                                                                                                                                                          • Opcode ID: 1aff8bba0b8b590d5ea2f3cefc5725af3d78cf8a422b5d79fa6caf9edfad25c2
                                                                                                                                                                                                                          • Instruction ID: 1265a61f578636872b1d870e4db8840d8612deff58be0f69358e126a2e4763ad
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1aff8bba0b8b590d5ea2f3cefc5725af3d78cf8a422b5d79fa6caf9edfad25c2
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 69E1C43261DAC2E5DA709B14E4912EBB374FBC9380F405536D6CD8ABAADF6DD544CB00
                                                                                                                                                                                                                          Function 00007FF660B4B680 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 270comCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AAB220: _Subatomic.LIBCONCRTD ref: 00007FF660AAB28E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                          • CoInitialize.OLE32 ref: 00007FF660B4BBAC
                                                                                                                                                                                                                          • CoCreateInstance.OLE32 ref: 00007FF660B4BBDD
                                                                                                                                                                                                                          • shared_ptr.LIBCMTD ref: 00007FF660B4BC13
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9190
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B4E0E0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF660B4E15B
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B4E0E0: HandleT.LIBCPMTD ref: 00007FF660B4E16A
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_CreateCriticalHandleInitializeInstanceLock::_ReentrantScoped_lockScoped_lock::~_Subatomictype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: SearchApp.exe$SearchHost.exe$SearchUI.exe$ShellExperienceHost.exe$StartMenuExperienceHost.exe$explorer.exe
                                                                                                                                                                                                                          • API String ID: 1408288539-3335880049
                                                                                                                                                                                                                          • Opcode ID: f2aace7d04c05300092beae39ae65f6895930096b24055f67442ddead2b6a803
                                                                                                                                                                                                                          • Instruction ID: b009a977d09b75e456af43df3f6e6867cf56875b6aa62393db9b274f19d299b0
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f2aace7d04c05300092beae39ae65f6895930096b24055f67442ddead2b6a803
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 73E1E436619AC5E1DAB09B15E4903EAB770FBC9780F408136DA8D8BB6ADF3DD544CB40
                                                                                                                                                                                                                          Function 00007FF660C3CD30 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 242comCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                          • CoCreateInstance.OLE32 ref: 00007FF660C3D0B8
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C39560: SetLastError.KERNEL32 ref: 00007FF660C39570
                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00007FF660C3D0D2
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A910CD
                                                                                                                                                                                                                          • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660C3D1C1
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$ErrorLast$Char_traitsConcurrency::details::_CreateInstanceSchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: CoCreateInstance+CLSID_AppVisibility+IID_IAppVisibility$CoInitialize+Init+Failed${"app" : {"hide_window": "menu_search"}}${"app" : {"hide_window": "menu_store"}}${"app" : {"menu_store" : {"top":%d,"left":%d,"bottom":%d,"right":%d}}}${"app" : {"show_window": "menu_store","menu_store" : {"top":%d,"left":%d,"bottom":%d,"right":%d}}}
                                                                                                                                                                                                                          • API String ID: 2502378382-2706694235
                                                                                                                                                                                                                          • Opcode ID: f8277111f4e857ef86293747225c18998e9baf22a982a14b7073960f6f0a3dcc
                                                                                                                                                                                                                          • Instruction ID: 10a6c86f9139f1f3ed48b611e9753104076b956d1e1fdb082a7ffb3f67e8bc96
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8277111f4e857ef86293747225c18998e9baf22a982a14b7073960f6f0a3dcc
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 01D1C332619AC2E1DA719B14E4913EBB3B4FBC9780F404536D68D8BBAADF2DD544CB40
                                                                                                                                                                                                                          Function 00007FF660C67270 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 245COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C55DD0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660C55DED
                                                                                                                                                                                                                          • Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF660C672E0
                                                                                                                                                                                                                          • std::runtime_error::runtime_error.LIBCPMTD ref: 00007FF660C6737F
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A93480: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A93493
                                                                                                                                                                                                                            • Part of subcall function 00007FF660CA3DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF660AA227F), ref: 00007FF660CA3DF0
                                                                                                                                                                                                                            • Part of subcall function 00007FF660CA3DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF660AA227F), ref: 00007FF660CA3E31
                                                                                                                                                                                                                          • Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF660C673E5
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90F30: char_traits.LIBCPMTD ref: 00007FF660A90F5D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9B51
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9B8C
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: shared_ptr.LIBCMTD ref: 00007FF660AD9BC8
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A90EAD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9580: shared_ptr.LIBCMTD ref: 00007FF660AD95B3
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9580: shared_ptr.LIBCMTD ref: 00007FF660AD963C
                                                                                                                                                                                                                          • allocator.LIBCPMTD ref: 00007FF660C67667
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B188C0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660B188D8
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C5C630: Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF660C5C655
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660C67733
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::$EmptyQueue::StructuredWork$Schedulershared_ptr$ProcessorProxyRoot::Virtual$Affinity::operator!=Concurrency::details::_ExceptionFileHardwareHeaderRaiseScheduler::_allocatorchar_traitsstd::runtime_error::runtime_errortype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: Could not open file for reading$extensions$settings
                                                                                                                                                                                                                          • API String ID: 486076642-1363464879
                                                                                                                                                                                                                          • Opcode ID: 66bd49a12bf4c780fc3e62dbc3f6c193fea90010edfe09c8fe337425a19d4d56
                                                                                                                                                                                                                          • Instruction ID: b14b0d5539373b2aec4bde78067709d8ff10305058e948a476b69489787dfb9c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 66bd49a12bf4c780fc3e62dbc3f6c193fea90010edfe09c8fe337425a19d4d56
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6DD1C13261DAC1A5DA709B15E4903EFB3B4FBC5380F405132D6CD8ABAAEF29D559CB40
                                                                                                                                                                                                                          Function 00007FF660A916D0 Relevance: 13.1, APIs: 4, Strings: 3, Instructions: 827COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C3E070: CoInitializeEx.OLE32 ref: 00007FF660C3E0E0
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AB8980: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660AB899A
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A91540: _Ptr_base.LIBCMTD ref: 00007FF660A9154E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A910CD
                                                                                                                                                                                                                          • CreateEventW.KERNEL32 ref: 00007FF660A91C48
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A997A0: GetDesktopWindow.USER32 ref: 00007FF660A997A9
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A997A0: EnumChildWindows.USER32 ref: 00007FF660A997BC
                                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32 ref: 00007FF660A91DEF
                                                                                                                                                                                                                          • CreateEventW.KERNEL32 ref: 00007FF660A91EEC
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B2C0B0: OpenEventW.KERNEL32 ref: 00007FF660B2C1D6
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660A91F52
                                                                                                                                                                                                                            • Part of subcall function 00007FF660CA2BD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF660CA2C00
                                                                                                                                                                                                                            • Part of subcall function 00007FF660CA2BD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF660CA2C06
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::CreateEmptyEventQueue::StructuredWork$Concurrency::cancel_current_task$Char_traitsChildConcurrency::details::_Decorator::getDesktopDirectoryEnumInitializeOpenPtr_baseSchedulerScheduler::_TableTypeWindowWindowsshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: ClosingEvent$DEBUGSCREEN_EVENT$\download
                                                                                                                                                                                                                          • API String ID: 3598548489-3079862309
                                                                                                                                                                                                                          • Opcode ID: f4b7fbf45a5c804b48c9aeaf5b06362cd183f27b091884b5be0f61d6379266ce
                                                                                                                                                                                                                          • Instruction ID: bf726d3b758b397959853ecf57955c6033037df19247e263a8cd6c02b3a484ae
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f4b7fbf45a5c804b48c9aeaf5b06362cd183f27b091884b5be0f61d6379266ce
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F7A2E632609FC5D1EA709B19E8953EBA3A4FBC5781F005535DA8D8BB9AEF3DC5448B00
                                                                                                                                                                                                                          Function 00007FF660B06000 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 178COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9190
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12420: RegCreateKeyW.ADVAPI32 ref: 00007FF660B12470
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12420: strrchr.LIBCMTD ref: 00007FF660B12487
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12420: RegQueryValueExW.ADVAPI32 ref: 00007FF660B124D3
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12420: RegCloseKey.ADVAPI32 ref: 00007FF660B124ED
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660B0620E
                                                                                                                                                                                                                          • std::ios_base::good.LIBCPMTD ref: 00007FF660B0622A
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12310: RegCreateKeyW.ADVAPI32 ref: 00007FF660B12347
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12310: RegQueryValueExW.ADVAPI32 ref: 00007FF660B12392
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12310: RegCloseKey.ADVAPI32 ref: 00007FF660B123A1
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$CloseCreateQueryValue$Char_traitsDecorator::getTableTypestd::ios_base::goodstrrchrtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: %lu$BuildNumber$CurrentBuild$SOFTWARE\Microsoft\Windows NT\CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
                                                                                                                                                                                                                          • API String ID: 1851878312-1501554625
                                                                                                                                                                                                                          • Opcode ID: 78eef4ff9267838125a51a80f133fc4ab1e6a6cd517bfd398c5a1f16e63858e4
                                                                                                                                                                                                                          • Instruction ID: f97e20414deefc69f9fca91dd4dcb3d4e57283a4ea9f6c6fe71ccb2689c44390
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 78eef4ff9267838125a51a80f133fc4ab1e6a6cd517bfd398c5a1f16e63858e4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 37A1E43661DAC1A4D6709B11E4903EBB374FBC9780F405136E6CD8ABAADF6DC554CB40
                                                                                                                                                                                                                          Function 00007FF660AAD500 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 102registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32 ref: 00007FF660AAD606
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A910CD
                                                                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32 ref: 00007FF660AAD681
                                                                                                                                                                                                                          • RegSetValueExW.ADVAPI32 ref: 00007FF660AAD6DA
                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32 ref: 00007FF660AAD6FE
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseFileModuleNameOpenValueshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: PCAppStore$Software\PCAppStore$status
                                                                                                                                                                                                                          • API String ID: 2919119571-3586994989
                                                                                                                                                                                                                          • Opcode ID: 234fa9274b0a9ac42d71d85466b3a3f1c36f2dca342b76cfd7ff7886e1aec786
                                                                                                                                                                                                                          • Instruction ID: b566f4c0cde500889ee23b7d6449a7972d7572ba12eedb5ca311a9f177c8022b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 234fa9274b0a9ac42d71d85466b3a3f1c36f2dca342b76cfd7ff7886e1aec786
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6951E472619BC1E6DA609B14E4813ABB7B4FBC5780F405136E68D87BAAEF3CD544CB00
                                                                                                                                                                                                                          Function 00007FF660C3E460 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 403COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                          • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF660C3E6D8
                                                                                                                                                                                                                          • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF660C3E7AE
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::$Affinity::operator!=EmptyHardwareQueue::StructuredWork$Char_traitsshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: Shell_TrayWnd$Taskbar
                                                                                                                                                                                                                          • API String ID: 2730265358-1897506974
                                                                                                                                                                                                                          • Opcode ID: 1d6bf15bf8ba67a0132862503bd0e79296bf97a2fb17d9dd3cd196390ed812c5
                                                                                                                                                                                                                          • Instruction ID: 1ad54466d57af907dc7c924d878f1bde78a177090864d3e11d9c55616a0bcd45
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1d6bf15bf8ba67a0132862503bd0e79296bf97a2fb17d9dd3cd196390ed812c5
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C922B632619AC1E5D660DB15E4912EAB3B4FBC9780F405136E6CD87BAAEF3CD944CB40
                                                                                                                                                                                                                          Function 00007FF660CC5434 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                          • Opcode ID: deb024806be0fd9c382c152b65c173cc0fc9aad457488d1f2eb23e871c80994f
                                                                                                                                                                                                                          • Instruction ID: 718315fe478ab456b9adb9fbb628e4044306e2e248db0c77b146256638c6d381
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: deb024806be0fd9c382c152b65c173cc0fc9aad457488d1f2eb23e871c80994f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 48C1B222A0C786E2E7619B15D4412BE77B5FF80B80F594231EA4E8B7D2DE7DE8858700
                                                                                                                                                                                                                          Function 00007FF660B12F10 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Message$MetricsSystem
                                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                                          • API String ID: 2388057244-4108050209
                                                                                                                                                                                                                          • Opcode ID: cca869797438b31eb8facd3317cb589d6587005e4eef270a41aee582d9d839c9
                                                                                                                                                                                                                          • Instruction ID: c387595e497ad0e5acfc54405e79f608a82a939a18466e3caf3566719172b290
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cca869797438b31eb8facd3317cb589d6587005e4eef270a41aee582d9d839c9
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 11011A726197859BE7248F20E15936BB7B5FB88744F405139E68E46B88DF7DC108CF00
                                                                                                                                                                                                                          Function 00007FF660B3BBA0 Relevance: 9.2, APIs: 6, Instructions: 249COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                          • Opcode ID: 4cc3fc690caf46b215ce346ccdf43ddad07f5910bdaaf1cb7ebd7b0cc30fae4f
                                                                                                                                                                                                                          • Instruction ID: d90f71512e4697238f54e0961538b62d77fdd0398d723f7a28788b9be27612e4
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4cc3fc690caf46b215ce346ccdf43ddad07f5910bdaaf1cb7ebd7b0cc30fae4f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BEC1F73260DAC1E6DA60DB15E4413EAB7B0EBC9790F504136E68D8BBAADF7DD444CB00
                                                                                                                                                                                                                          Function 00007FF660AA62C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A910CD
                                                                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32 ref: 00007FF660AA643E
                                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32 ref: 00007FF660AA64F7
                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32 ref: 00007FF660AA6523
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseOpenQueryValueshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: Software\PCAppStore$status
                                                                                                                                                                                                                          • API String ID: 2952970082-3794422696
                                                                                                                                                                                                                          • Opcode ID: bf8adccc2c49f5d164e4e713ac13f9a82795e8251945bf110365b908d4a9083c
                                                                                                                                                                                                                          • Instruction ID: 5520930243910f19c81681f2294e885bd453ef5c60e9abcdf06d3505caf7d855
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bf8adccc2c49f5d164e4e713ac13f9a82795e8251945bf110365b908d4a9083c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6C61A132619AC1E5DA609B14E4913EBB3B4FBC4780F405136E68D87BAAEF3DD548CB40
                                                                                                                                                                                                                          Function 00007FF660B4AB80 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A910CD
                                                                                                                                                                                                                          • OpenEventW.KERNEL32 ref: 00007FF660B4AC42
                                                                                                                                                                                                                          • shared_ptr.LIBCMTD ref: 00007FF660B4ACFD
                                                                                                                                                                                                                          • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF660B4AD10
                                                                                                                                                                                                                          • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF660B4AD5E
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::$EmptyQueue::StructuredWork$shared_ptr$Affinity::operator!=Char_traitsEventFac_nodeFac_node::_HardwareOpenstd::_type_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: DEBUGSCREEN_EVENT
                                                                                                                                                                                                                          • API String ID: 4219698036-491765807
                                                                                                                                                                                                                          • Opcode ID: d060b9267e49243510d7b1e2194a8ff1b6122a82cebdf5fa62c23b40d6cdc4ad
                                                                                                                                                                                                                          • Instruction ID: c612fe096cf219006d14c8e13efb77fb4829f94d40344385a6ab334158cf3b09
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d060b9267e49243510d7b1e2194a8ff1b6122a82cebdf5fa62c23b40d6cdc4ad
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5551083261DAC5E1DA60EB15E4913EBA374FBC9780F404136E6CD8BBAADE2DD505CB40
                                                                                                                                                                                                                          Function 00007FF660CAFC38 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2067211477-0
                                                                                                                                                                                                                          • Opcode ID: 98fd7ff7b0ded043c1c8bd62d9dc79a70e5c77a2b738dab7989ce3feaa60c173
                                                                                                                                                                                                                          • Instruction ID: 102418d55472feb0a8c401fe70dd7b0e890b54e66aa2a6cd1948640fed4ce665
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 98fd7ff7b0ded043c1c8bd62d9dc79a70e5c77a2b738dab7989ce3feaa60c173
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1F213D25A09B86EAEE149FA6A45117AA3B0EF88B94F284531EE4D8B755DF3CE4018700
                                                                                                                                                                                                                          Function 00007FF660AACDD0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 273COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AACFDE
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A910CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9190
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12310: RegCreateKeyW.ADVAPI32 ref: 00007FF660B12347
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12310: RegQueryValueExW.ADVAPI32 ref: 00007FF660B12392
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12310: RegCloseKey.ADVAPI32 ref: 00007FF660B123A1
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • {"app" : { "init" : {"guid":"%ws","cache_folder_path":"%ws", "engine_version":"%ws", "windows_version":"%ws", "locale_layout":"%ws, xrefs: 00007FF660AACE1B
                                                                                                                                                                                                                          • widgetInfo, xrefs: 00007FF660AAD19B
                                                                                                                                                                                                                          • {"app": {"widget":{"savedPosition": {"x": %d, "y": %d}}}}, xrefs: 00007FF660AAD30B
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Char_traitsCloseCreateQueryValuetype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: widgetInfo${"app" : { "init" : {"guid":"%ws","cache_folder_path":"%ws", "engine_version":"%ws", "windows_version":"%ws", "locale_layout":"%ws${"app": {"widget":{"savedPosition": {"x": %d, "y": %d}}}}
                                                                                                                                                                                                                          • API String ID: 2877627145-1185860185
                                                                                                                                                                                                                          • Opcode ID: 44913fc5e0df5e4b763c1c27893c440a16d88f5e51f2368b9f1a135728a16c6d
                                                                                                                                                                                                                          • Instruction ID: 40bb73610285fde7810a0f16ff780869dc08a19f9894515f9bbc2766004a2651
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 44913fc5e0df5e4b763c1c27893c440a16d88f5e51f2368b9f1a135728a16c6d
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7CF17B36619BC5A5DAB19B15E8803DAB3B4FBC9780F404136DACC87B6AEF39C554CB40
                                                                                                                                                                                                                          Function 00007FF660AD89D0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90F30: char_traits.LIBCPMTD ref: 00007FF660A90F5D
                                                                                                                                                                                                                          • Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF660AD8B79
                                                                                                                                                                                                                          • Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF660AD8CB7
                                                                                                                                                                                                                          • Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF660AD8CDF
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00007FF660AD89EE
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::task_continuation_context::task_continuation_context$char_traits
                                                                                                                                                                                                                          • String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
                                                                                                                                                                                                                          • API String ID: 3112460731-1713319389
                                                                                                                                                                                                                          • Opcode ID: b7a086962086a4a3b8ff3ea580c156ee40cde518962ec9efe31518dd0ce3de4f
                                                                                                                                                                                                                          • Instruction ID: ff18140bcf11862293c006ab48858c9f87c82d72a6f1ca805cf48b9096f01cf6
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b7a086962086a4a3b8ff3ea580c156ee40cde518962ec9efe31518dd0ce3de4f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0591FA63618651D6E724CB18E45637AB2B0F7C8748F141236EACECABE9DB6CD941CF04
                                                                                                                                                                                                                          Function 00007FF660C3F510 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 166COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::_SchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: 2${"app": {"init":{"direction":"%c","screen_size":{"with_topbar":%d,"t":%d,"l":%d,"b":%d,"r":%d}}}}
                                                                                                                                                                                                                          • API String ID: 3472098950-2542400605
                                                                                                                                                                                                                          • Opcode ID: a536af6bddb9038f5fbde864953fa27f9d4b4a7cd9ceb0a7c9d972ab4471597e
                                                                                                                                                                                                                          • Instruction ID: d7558b2e6536de343779ce0ed298ff1cac3c5a3c42f63413229d1050cce6efd4
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a536af6bddb9038f5fbde864953fa27f9d4b4a7cd9ceb0a7c9d972ab4471597e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9591B236619BC5AADA70DB59F48439AB7B0F7C9B80F404126DA8D87B6ADF39D444CF00
                                                                                                                                                                                                                          Function 00007FF660C52560 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 130COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::_SchedulerScheduler::_
                                                                                                                                                                                                                          • String ID: 0u${"app": {"topbar": { "fullScreenMode": %d }}}${"app": {"topbar": { "rBinStatus": %d }}}
                                                                                                                                                                                                                          • API String ID: 2780765137-351494797
                                                                                                                                                                                                                          • Opcode ID: a58a6161b92b90a5fe939f71ae6c90e414e61a31c6eaace5286abb693c336b3e
                                                                                                                                                                                                                          • Instruction ID: 10754b1a1a5a90faaccb74393abda893546ddd5d159229fa8dfba353887cc7a1
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a58a6161b92b90a5fe939f71ae6c90e414e61a31c6eaace5286abb693c336b3e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EF61FE36619BC1A5EA609B15E4903EBB7B0FBC5780F404136EA8D8BB6ADF3DD544CB40
                                                                                                                                                                                                                          Function 00007FF660C40E70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseConcurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorOpen
                                                                                                                                                                                                                          • String ID: registry was not opened
                                                                                                                                                                                                                          • API String ID: 151454242-1342567452
                                                                                                                                                                                                                          • Opcode ID: 29ed2c5768aae87f00a30fec505e54591c035aa2d7948d4531ccb821d862c129
                                                                                                                                                                                                                          • Instruction ID: e7335961a277e1578df60b8482e4947e6ac3c81fbfff91d12f36f83fe82da9ff
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 29ed2c5768aae87f00a30fec505e54591c035aa2d7948d4531ccb821d862c129
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4F51D232619AC1E5DA609B15E8913ABB3B4FBC5780F405036EACD8BB6ADF3CD554CB00
                                                                                                                                                                                                                          Function 00007FF660C3F970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: System$Metrics$FromInfoMonitorParametersPoint
                                                                                                                                                                                                                          • String ID: (
                                                                                                                                                                                                                          • API String ID: 865970660-3887548279
                                                                                                                                                                                                                          • Opcode ID: 8de2ccf0eee743cc24f2e1e0ab168865291da9ff07c420a23c76ec079640e17f
                                                                                                                                                                                                                          • Instruction ID: 27a12eb3cabb20010bb1bfd5c31342d5effda7a60ff85098d4b3cdb344aae81d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8de2ccf0eee743cc24f2e1e0ab168865291da9ff07c420a23c76ec079640e17f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9E313E3295C786DAD3658F25A05022ABBB1EFC8B94F008535E68E8BB55CF3CD9429F00
                                                                                                                                                                                                                          Function 00007FF660A9AFB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62synchronizationCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A910CD
                                                                                                                                                                                                                          • OpenEventW.KERNEL32 ref: 00007FF660A9B069
                                                                                                                                                                                                                          • WaitForSingleObject.KERNEL32 ref: 00007FF660A9B094
                                                                                                                                                                                                                          • CloseHandle.KERNEL32 ref: 00007FF660A9B0B5
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseEventHandleObjectOpenSingleWaitshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: ClosingEvent
                                                                                                                                                                                                                          • API String ID: 4183184898-2998232585
                                                                                                                                                                                                                          • Opcode ID: 8eb1ce6614611f55027886c36a5f75db051196db64d816248b825bfee145e235
                                                                                                                                                                                                                          • Instruction ID: d1e72b8514dabd45261c8aa37c396069716f519c18f47c302308c933f35a0d79
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8eb1ce6614611f55027886c36a5f75db051196db64d816248b825bfee145e235
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 66312E32618A81E2EA509B11E4812AFB7B5FBC4380F504135E68D86B7ADF3DD545CB00
                                                                                                                                                                                                                          Function 00007FF660AD98A0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD89D0: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF660AD8B79
                                                                                                                                                                                                                          • shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD7D60: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660AD7D7A
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::task_continuation_context::task_continuation_contextDecorator::getTableTypeshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 4040233825-0
                                                                                                                                                                                                                          • Opcode ID: 42c90e878669586546bd47c4aac059a84cf45b7df95969407fa1727e5b9069fb
                                                                                                                                                                                                                          • Instruction ID: 5964cc6101a375c7e9732bb5793581c180861dc2ddd40183388c4ace5e932815
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 42c90e878669586546bd47c4aac059a84cf45b7df95969407fa1727e5b9069fb
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1A41043361DA86E1DA20EB15E4912EEB770FBC4780F401532E6CD87BAADE2CD548CB00
                                                                                                                                                                                                                          Function 00007FF660ADB0C0 Relevance: 6.1, APIs: 4, Instructions: 78synchronizationCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$ObjectSingleWait
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 282557418-0
                                                                                                                                                                                                                          • Opcode ID: e84f3ad846ed64f9196f56f3fe06c159fe096eb6db7144feb365fa05972e167c
                                                                                                                                                                                                                          • Instruction ID: 9364ea0843392941c753173782e96c22ea3160a2af5510980fbf61808c9fe765
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e84f3ad846ed64f9196f56f3fe06c159fe096eb6db7144feb365fa05972e167c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3D313C22E18646D2EE109B29E45526E73B0FF857C4F900635EE8D8B7E7DE3CD4428B04
                                                                                                                                                                                                                          Function 00007FF660B12420 Relevance: 6.1, APIs: 4, Instructions: 74registrystringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseCreateQueryValuestrrchr
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2429320508-0
                                                                                                                                                                                                                          • Opcode ID: 7c12e76c81dc16c8822931cc68bfae7e375ac47037923e780dd9e0743e314af7
                                                                                                                                                                                                                          • Instruction ID: 2e0945bd3dc0e3868abfc8933d6f6fb55b9710b42725048d622678f4465abdea
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7c12e76c81dc16c8822931cc68bfae7e375ac47037923e780dd9e0743e314af7
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4731F733629A81E2DA50DB21E4816ABB370FBC5780F505536E6CE8BB6ADF7DD4048B40
                                                                                                                                                                                                                          Function 00007FF660B2F480 Relevance: 6.1, APIs: 4, Instructions: 60comfileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CreateInitialize$FileIcmpInstanceSecurity
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 897544864-0
                                                                                                                                                                                                                          • Opcode ID: e4a8fba4a3a2cf6652689b814b655aac69ce770b39fc8cbd7eb8e22504de9c34
                                                                                                                                                                                                                          • Instruction ID: 02ec86c1dbf6c5011a25b52638a67180df3512f7d069be60dc5d4d70f8229268
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e4a8fba4a3a2cf6652689b814b655aac69ce770b39fc8cbd7eb8e22504de9c34
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 09310F32A08B8992EB11DF2AE45536F7771FB85B94F104235EA9D4B7A5CF3DE0048B40
                                                                                                                                                                                                                          Function 00007FF660B12310 Relevance: 6.1, APIs: 4, Instructions: 58registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Close$CreateQueryValue
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2495337196-0
                                                                                                                                                                                                                          • Opcode ID: 560ce2b6002fda1f48c0e2119564795e5af3fb434074bb728d858a953253bbc0
                                                                                                                                                                                                                          • Instruction ID: 70ce509fd6dd74e3e8b8660659f50e4e0b6a985389d6508fbb0eecc9731cd65d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 560ce2b6002fda1f48c0e2119564795e5af3fb434074bb728d858a953253bbc0
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0021BA6262DA81E1DA50DB25E45116FB7B0FBC5780F101035F7CE8BB6ACF6DE4548B40
                                                                                                                                                                                                                          Function 00007FF660B125A0 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • RegCreateKeyW.ADVAPI32 ref: 00007FF660B125CE
                                                                                                                                                                                                                          • RegSetValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF660AAF86D), ref: 00007FF660B1261A
                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF660AAF86D), ref: 00007FF660B12629
                                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF660AAF86D), ref: 00007FF660B12657
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Close$CreateValue
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1009429713-0
                                                                                                                                                                                                                          • Opcode ID: 7276f55dccbbdba195227a01b48dd228f0e69ce8f0cf39afd03d7a8aeece0958
                                                                                                                                                                                                                          • Instruction ID: 77412f4d540c2384e60e1696dcf7556883e272825ace80e5bd888f2e35990b65
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7276f55dccbbdba195227a01b48dd228f0e69ce8f0cf39afd03d7a8aeece0958
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E621C96262CA81E6DA50DB26E45126FA770FBC5780F101435F7CE8AB6ACF2DD4548B40
                                                                                                                                                                                                                          Function 00007FF660C422D0 Relevance: 6.0, APIs: 4, Instructions: 45registrywindowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ChangeCloseDecorator::getExceptionFileFormatHeaderMessageNotifyRaiseTableTypeValuestd::bad_exception::bad_exception
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 364703902-0
                                                                                                                                                                                                                          • Opcode ID: eb16407a55bedfc082493dc2b5cacc50af7eef1171e8d3171c4d170d14618321
                                                                                                                                                                                                                          • Instruction ID: 0b540b196bb46cfe7c210d3d9e3c0a6086d34e3ce2624398df7f725b8d0c49ed
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: eb16407a55bedfc082493dc2b5cacc50af7eef1171e8d3171c4d170d14618321
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 07211A72618B81E6E720DB15E44436AB7B0FBC5788F504035EA8D87BA9DFBDD549CB00
                                                                                                                                                                                                                          Function 00007FF660B3B750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                          • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF660B3B826
                                                                                                                                                                                                                          • HandleT.LIBCPMTD ref: 00007FF660B3B835
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B3B6E0: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,00007FF660B3B882), ref: 00007FF660B3B709
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_CriticalHandleLock::_OpenProcessReentrantScoped_lockScoped_lock::~_type_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: NW_store.exe
                                                                                                                                                                                                                          • API String ID: 131083509-3827304589
                                                                                                                                                                                                                          • Opcode ID: 908a3785184dacab076b5fad28a87f3c6b692e18efd8f8c339602ab9e295a860
                                                                                                                                                                                                                          • Instruction ID: 5c58089c44a61ef704c0002b777c69f18ffab1ce88541a26402efb6c34f0a509
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 908a3785184dacab076b5fad28a87f3c6b692e18efd8f8c339602ab9e295a860
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D741DA3260DA81E6DA609B15E4403AAB7B4FBC9784F504136E7CD8AB6ADF2DD944CB00
                                                                                                                                                                                                                          Function 00007FF660ADAF80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63timeCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                          • WinHttpOpen.WINHTTP ref: 00007FF660ADB00E
                                                                                                                                                                                                                          • WinHttpSetTimeouts.WINHTTP ref: 00007FF660ADB080
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: shared_ptr$Concurrency::details::EmptyHttpQueue::StructuredWork$Char_traitsOpenTimeoutstype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: WinHTTP 1.0
                                                                                                                                                                                                                          • API String ID: 2528808869-2851767304
                                                                                                                                                                                                                          • Opcode ID: 92c83c6423ad0cbd4c443393dd7077c058d7ccd3dd8c28dfbd58a898d25411b7
                                                                                                                                                                                                                          • Instruction ID: b10bd915f458838e6231019ccc151455af02e0cd094f61b4f0bd4ed0e40affb4
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 92c83c6423ad0cbd4c443393dd7077c058d7ccd3dd8c28dfbd58a898d25411b7
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5231FB32628A81E6EA50DB15E4447AFB7B1FBC0780F505135EA8E8BBA9DF7DD444CB40
                                                                                                                                                                                                                          Function 00007FF660AD8E90 Relevance: 4.7, APIs: 3, Instructions: 168COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Decorator::getTableType$shared_ptr$Char_traitsConcurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 43780872-0
                                                                                                                                                                                                                          • Opcode ID: b84b4a2511fb982144c7d429468c844d9ab2def749891cb9dbf0faf9c5b57989
                                                                                                                                                                                                                          • Instruction ID: 78f26d00b893d2cd28c999865c530e51a71555aff01048b368aec9b806e1cf1d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b84b4a2511fb982144c7d429468c844d9ab2def749891cb9dbf0faf9c5b57989
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DC81C63361DA85E1DA70AB15E4913EAB370FBC5784F405532E68D8BBAAEF2CD504CB40
                                                                                                                                                                                                                          Function 00007FF660AD9AA0 Relevance: 4.6, APIs: 3, Instructions: 108COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                          • type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9B51
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9B8C
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD89D0: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF660AD8B79
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD7D60: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660AD7D7A
                                                                                                                                                                                                                          • shared_ptr.LIBCMTD ref: 00007FF660AD9BC8
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Char_traitsConcurrency::details::Concurrency::task_continuation_context::task_continuation_contextDecorator::getEmptyQueue::StructuredTableTypeWorkshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2402306799-0
                                                                                                                                                                                                                          • Opcode ID: 1d91c1566532990faaf23e5970af6109f64c42692b4b7ac5f6dcc6cf0e6778d5
                                                                                                                                                                                                                          • Instruction ID: 02c29efcdd5498e856ad4c6765eb36a3380f03dbb2673d651135dd4b69862839
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1d91c1566532990faaf23e5970af6109f64c42692b4b7ac5f6dcc6cf0e6778d5
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2551D63361DA86E1DA60DB15E4913EAB770FBD5780F405532E6CD87BAADE2CD508CB40
                                                                                                                                                                                                                          Function 00007FF660C84E5C Relevance: 4.6, APIs: 3, Instructions: 95COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Lockitstd::_$Concurrency::cancel_current_taskLockit::_Lockit::~_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2115809835-0
                                                                                                                                                                                                                          • Opcode ID: 884059259a7ae9d84c4e346144cf8cb6122bea1736f0bb3a1a37e3dc46d3a365
                                                                                                                                                                                                                          • Instruction ID: 92a02c4842b6989298f08537e48be0cc87fc655437c5bf3f80b73cfdfc6830e8
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 884059259a7ae9d84c4e346144cf8cb6122bea1736f0bb3a1a37e3dc46d3a365
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 46418832619B85E1EB14DB15E4802696774FF88FC4F008432DE4E8BB69DF38D951C344
                                                                                                                                                                                                                          Function 00007FF660A8B5D0 Relevance: 4.6, APIs: 3, Instructions: 89COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWorkchar_traits$Max_valueMin_value
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2926028262-0
                                                                                                                                                                                                                          • Opcode ID: e39de02eebfb42b1296a69f08ef3f680c82487d490f3d30a3846c76b507564e3
                                                                                                                                                                                                                          • Instruction ID: 1e9c7012db7aee93a2230c35d24f71c6afcc5e989bb714c60ce9fca46cba3bbb
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e39de02eebfb42b1296a69f08ef3f680c82487d490f3d30a3846c76b507564e3
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5F410B27A1DB85D2DA10EB16E05016EA7B1FBC97C4F101136FA8D87B6ADF3CD5408B40
                                                                                                                                                                                                                          Function 00007FF660B243D0 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B243F2
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B05CE0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B05CF1
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B24475
                                                                                                                                                                                                                          • _Bitmask_includes.LIBCPMTD ref: 00007FF660B244DC
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$Bitmask_includes
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2390111963-0
                                                                                                                                                                                                                          • Opcode ID: a83db4324a4abcfd552098a8bf7e40096f33cd78f084c4a2e058ad9279e2f5f2
                                                                                                                                                                                                                          • Instruction ID: 5273bc51ec7721be89e2bbc935449e534a4264aa4bda15c6622f657a81748fff
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a83db4324a4abcfd552098a8bf7e40096f33cd78f084c4a2e058ad9279e2f5f2
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7C41FF2290C686E6E670EB11E4453BAB7B0FBD9384F404135E6CE8BB9ACF2DD545CB40
                                                                                                                                                                                                                          Function 00007FF660C67830 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 181COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660C67944
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A90EAD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C5B680: _Idl_distance.LIBCPMTD ref: 00007FF660C5B6CF
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90F30: char_traits.LIBCPMTD ref: 00007FF660A90F5D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9B51
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9B8C
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: shared_ptr.LIBCMTD ref: 00007FF660AD9BC8
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9580: shared_ptr.LIBCMTD ref: 00007FF660AD95B3
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9580: shared_ptr.LIBCMTD ref: 00007FF660AD963C
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Idl_distancechar_traitstype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: profile
                                                                                                                                                                                                                          • API String ID: 4115068943-2170006031
                                                                                                                                                                                                                          • Opcode ID: b44fbb86f757ae24ea849746dde8cc28950dec950d89d1efe2f28bafe1324383
                                                                                                                                                                                                                          • Instruction ID: 0dc627ec87c7b7442d9e845ba0618fbc47f503d98e78cb10aca69f0e2a0c5293
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b44fbb86f757ae24ea849746dde8cc28950dec950d89d1efe2f28bafe1324383
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0391C23261DAC6E1DA709B15E4913EBB3B0FBC5380F405532E68D8BBAADE2DD545CB40
                                                                                                                                                                                                                          Function 00007FF660AF9C90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52processCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CreateProcessstrrchr
                                                                                                                                                                                                                          • String ID: h
                                                                                                                                                                                                                          • API String ID: 4037516736-2439710439
                                                                                                                                                                                                                          • Opcode ID: 0b4d67693e087f15374fe2cb39532bd0f8a7dd7e7352cbe55a5af5981feb850d
                                                                                                                                                                                                                          • Instruction ID: b21ef62504242328e6beccf45517012c485c6676280931871be42ec32b1f082b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0b4d67693e087f15374fe2cb39532bd0f8a7dd7e7352cbe55a5af5981feb850d
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4221D632618A82A6E750DB54E4907AFB7B0FBD0394F504035E68D86BAADFBDD518CB40
                                                                                                                                                                                                                          Function 00007FF660AD9580 Relevance: 3.1, APIs: 2, Instructions: 147COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Decorator::getTableTypeshared_ptr
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 143873753-0
                                                                                                                                                                                                                          • Opcode ID: 621d3963b75800fd4e324ce53e8d1ab3c2f2d785b822c1f5598698b4f0e1385f
                                                                                                                                                                                                                          • Instruction ID: 60ec6e1ef0c8fbd391f90edebf1d3936defead558e86894553c014af6cf28887
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 621d3963b75800fd4e324ce53e8d1ab3c2f2d785b822c1f5598698b4f0e1385f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F271A23361DA85E1DA70AB15E4913EAB370FBC9784F405532EA8D87BAADF2CD544CB40
                                                                                                                                                                                                                          Function 00007FF660CB6858 Relevance: 3.1, APIs: 2, Instructions: 132COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                          • Opcode ID: e880bca60e20fa46b069a9fa51f681df6431c92be232c2e0220b988f896fe569
                                                                                                                                                                                                                          • Instruction ID: 124715bdd97cebee4f1201990357fa24b260ad21d1a74ad932b1055f26405b44
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e880bca60e20fa46b069a9fa51f681df6431c92be232c2e0220b988f896fe569
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AE51D032909642D7EA648B29D94127973B0EF55B94F240231DA8ECB7D1CF7DE483C751
                                                                                                                                                                                                                          Function 00007FF660CB689C Relevance: 3.1, APIs: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                          • Opcode ID: 6a5b8f90e18411c57f8b0fba21bd4e9db6e17063562557f0c65fbbde9f2cf7de
                                                                                                                                                                                                                          • Instruction ID: bd3ee862e2621454df46d0758a4163c80200533c3e6b77368d1884667705fadc
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6a5b8f90e18411c57f8b0fba21bd4e9db6e17063562557f0c65fbbde9f2cf7de
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A7315832A18E46E2EA50DB14E9511B96371EF94B94FA80235EA4E8B3D2EF3DE5058710
                                                                                                                                                                                                                          Function 00007FF660B4E0E0 Relevance: 3.1, APIs: 2, Instructions: 76COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1248567937-0
                                                                                                                                                                                                                          • Opcode ID: 2eb23e00f090d690dc6930224ae3b56abd273f48cf423ff75d13c6f6e99552a9
                                                                                                                                                                                                                          • Instruction ID: e072cd0c73b54d06d9f80718a442675e95a4d3b780a5cba12326f3c04aa8b22e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2eb23e00f090d690dc6930224ae3b56abd273f48cf423ff75d13c6f6e99552a9
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6D31303261CA85E1DA60DB15E4412AFA770FBCA784F504035E6CE8BB6ADF7DD504CB40
                                                                                                                                                                                                                          Function 00007FF660C423C0 Relevance: 3.1, APIs: 2, Instructions: 57registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: QueryValue
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3660427363-0
                                                                                                                                                                                                                          • Opcode ID: 8255e4681818947f7ead3aea93db6fb5ee972568b12f96a755b376553cfc7fd9
                                                                                                                                                                                                                          • Instruction ID: c00e1c54535f6cdbc10f3b6cf43b78670ff0b1c72e30c1a7a4e7ba454fcb096b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8255e4681818947f7ead3aea93db6fb5ee972568b12f96a755b376553cfc7fd9
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0621C836A29B81E2DA908B15E49566BB3B4FF85794F942135FACD87B28DF3CD444CB00
                                                                                                                                                                                                                          Function 00007FF660B3C8F0 Relevance: 3.1, APIs: 2, Instructions: 57COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1248567937-0
                                                                                                                                                                                                                          • Opcode ID: 6259cd2f35501cca621f465b231549dc02cee1e7ff83562af2d86eda4b7ef69a
                                                                                                                                                                                                                          • Instruction ID: 1776ad8c5ecd89b6ee45c288e620cdbd4aa6ad94f36107ca9e0a2669c6cbefcf
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6259cd2f35501cca621f465b231549dc02cee1e7ff83562af2d86eda4b7ef69a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9921712251CA91E2DA20D715E44127FABB4EBCE7C4F640531F7CE8ABAADF2DC5558B00
                                                                                                                                                                                                                          Function 00007FF660ADEBD0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CallDecorator::getIndexatomicshared_ptr
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3391904811-0
                                                                                                                                                                                                                          • Opcode ID: 112a7a1cfea1af6a49f72f60085d69459d96c49a4b2313b8b527eccd42334bbb
                                                                                                                                                                                                                          • Instruction ID: 7ee01d4ccb2e468c35ca6da618470876eb056da16ec63442ed5d4129b3a03b44
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 112a7a1cfea1af6a49f72f60085d69459d96c49a4b2313b8b527eccd42334bbb
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C411B237628A85D2DA50DB19E48155EB7B4FBC8B84F505122EB8E87B69DF3CC514CB00
                                                                                                                                                                                                                          Function 00007FF660B05F00 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: AttributesEnvironmentExpandFileStrings
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3836626501-0
                                                                                                                                                                                                                          • Opcode ID: cf2b42f781f452ba8887e965ace6311404eaabd47bc012664cabe273c61bef76
                                                                                                                                                                                                                          • Instruction ID: b4b59c63b87a8af750ec7b365095cae2e90833d28ce2324f8a1f657b01ef25de
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cf2b42f781f452ba8887e965ace6311404eaabd47bc012664cabe273c61bef76
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 01F04931A2C683E6E6609B24E84977F6270FB85764F904235E5AFCABD4EE3CD4058A44
                                                                                                                                                                                                                          Function 00007FF660CA2BD0 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1173176844-0
                                                                                                                                                                                                                          • Opcode ID: 79828b8057ac0c13fd60be7f73fd30bcbbf421bb2b822df6622cab7814d851e4
                                                                                                                                                                                                                          • Instruction ID: 92f51e078f625ae89eda559c8635e9f66518396716ebc85a5ede80f497a207fa
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 79828b8057ac0c13fd60be7f73fd30bcbbf421bb2b822df6622cab7814d851e4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5AE0EC40E0E117F7FD6C256A28761B502B40F09370E385B30D93ECC3C2AE3CA8968120
                                                                                                                                                                                                                          Function 00007FF660B317A0 Relevance: 3.0, APIs: 2, Instructions: 16COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Window$ShowUpdate
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2310006639-0
                                                                                                                                                                                                                          • Opcode ID: 27d96b2e2a6ebb7af6f79fd039629226fea3c2d1ac42639d18c704751faeff7c
                                                                                                                                                                                                                          • Instruction ID: 26e3eddcc531256cd01c28a51e216071f2cfe75e910e29da2b054d9370174591
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 27d96b2e2a6ebb7af6f79fd039629226fea3c2d1ac42639d18c704751faeff7c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 03E04F76A25B85C2DB409F16D88122A67B0FBC8F80F459031EE4E87364DF3CC845C700
                                                                                                                                                                                                                          Function 00007FF660B4CB80 Relevance: 3.0, APIs: 2, Instructions: 10COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ChildDesktopEnumWindowWindows
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2514311848-0
                                                                                                                                                                                                                          • Opcode ID: b0fd43d6e0e94c28da821d992680c33c943c97e8262ce344efbf5b071f0ff684
                                                                                                                                                                                                                          • Instruction ID: 5d09d4ec12f5be3ae7c4396db8b7e21f1d3dc0e8960ee51b28b2a604dd4d26c7
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b0fd43d6e0e94c28da821d992680c33c943c97e8262ce344efbf5b071f0ff684
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A1C01265E16746E1DA046F65E89A1352370BF4E741FD09430C50D497158E3CA15D8F00
                                                                                                                                                                                                                          Function 00007FF660A997A0 Relevance: 3.0, APIs: 2, Instructions: 10COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ChildDesktopEnumWindowWindows
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2514311848-0
                                                                                                                                                                                                                          • Opcode ID: 815231a326fdbdcc2087a3ba038e825c9bf287463471365a8762f450db156d53
                                                                                                                                                                                                                          • Instruction ID: 197effdd51f1a67b0b9f9dbdceb52308ebe467ead6f3526cd78761cc8e9dc562
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 815231a326fdbdcc2087a3ba038e825c9bf287463471365a8762f450db156d53
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 89C01266E26746E1DA046F65F89A1352370FF49741FD09030C50D497118E3CA059CF00
                                                                                                                                                                                                                          Function 00007FF660CC0DD4 Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 485612231-0
                                                                                                                                                                                                                          • Opcode ID: b14f49c57cee8635011c431eaae8e23fe290bbf5ee1f602fc278b6c7871e509f
                                                                                                                                                                                                                          • Instruction ID: e2eb17c2b2c9279650311eb5470070c54e9e8c5c27129d6ef885a7b9601a9b6b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b14f49c57cee8635011c431eaae8e23fe290bbf5ee1f602fc278b6c7871e509f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DAE05B54F0A687E3FF1D67F2A9461791275DF98744F180434D90ECE392EE3CA9955340
                                                                                                                                                                                                                          Function 00007FF660B21C90 Relevance: 1.6, APIs: 1, Instructions: 124COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: std::ios_base::goodstd::ios_base::width
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3809604888-0
                                                                                                                                                                                                                          • Opcode ID: 3193a1262e75117fb15c433224b95aaa7245344bdfe751e5dc239a77d01d1b28
                                                                                                                                                                                                                          • Instruction ID: ab91795001920c29a217441c85a7004f1e4976392ac0c12d22dceb43fcf3f7c7
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3193a1262e75117fb15c433224b95aaa7245344bdfe751e5dc239a77d01d1b28
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 63511C62A0C685DAD730DB25E04137AB7B0EB99784F148536E68ECBB9ADE3DD501CF40
                                                                                                                                                                                                                          Function 00007FF660AFC490 Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetWindowTextW.USER32 ref: 00007FF660AFC4C6
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9190
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredTextWindowWork
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2447981796-0
                                                                                                                                                                                                                          • Opcode ID: ecb2bb2f619f7ae22338fac7fcb570c9a161520eeb84576003ee13a1a58bb572
                                                                                                                                                                                                                          • Instruction ID: fcd30ac100bd4a9fe45c4bd602204b79e721fecf0642690aa9d9a840429f4965
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ecb2bb2f619f7ae22338fac7fcb570c9a161520eeb84576003ee13a1a58bb572
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B141D833618A81E6E6609B15E4413ABB7B4FBC4784F501636E6CD8ABAADF7CD504CB00
                                                                                                                                                                                                                          Function 00007FF660AEA3F0 Relevance: 1.6, APIs: 1, Instructions: 87COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: __crt_scoped_stack_ptr
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1704660383-0
                                                                                                                                                                                                                          • Opcode ID: 2b64867363028eff0c91442592d46d6c6cb3060f987761c6e3f93457ab4b6b66
                                                                                                                                                                                                                          • Instruction ID: f12d53b914e79b2befa6fcda887073fbb2166bb8227aaa7600dd5a161ee7e7e0
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2b64867363028eff0c91442592d46d6c6cb3060f987761c6e3f93457ab4b6b66
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E941C36361DA81D1DA609B15E4903AFB7B5FBC4784F404136EA8D8BBAADF2CD548CB40
                                                                                                                                                                                                                          Function 00007FF660CC5314 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                          • Opcode ID: 321343d00294838cecd101b12ef5f71ea6e8db055736ae24a32fa14de0d5b621
                                                                                                                                                                                                                          • Instruction ID: f5eef7cefee32b4a15ee380986336734fde7076a9260c7305f3bfc260a5e9cbc
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 321343d00294838cecd101b12ef5f71ea6e8db055736ae24a32fa14de0d5b621
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DA318F21A18682E6F715AB55C84237D2670EF44BE4F550235EA1DCF3E2DFBDE8818711
                                                                                                                                                                                                                          Function 00007FF660C40210 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CreateEventW.KERNEL32 ref: 00007FF660C40238
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C40D40: _Ptr_base.LIBCPMTD ref: 00007FF660C40E31
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C422D0: RegNotifyChangeKeyValue.ADVAPI32 ref: 00007FF660C42308
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C422D0: FormatMessageW.KERNEL32 ref: 00007FF660C42353
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C422D0: RegCloseKey.ADVAPI32 ref: 00007FF660C4236C
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C422D0: std::bad_exception::bad_exception.LIBCMTD ref: 00007FF660C4238D
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ChangeCloseCreateEventFormatMessageNotifyPtr_baseValuestd::bad_exception::bad_exception
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1108121324-0
                                                                                                                                                                                                                          • Opcode ID: d131e54128c23b049350c72a160e8f6a443448de3b4584595088c6dbcf7bcdaa
                                                                                                                                                                                                                          • Instruction ID: d4554f31a111121453a27b0367550bb307584078099aa38b45e92e1cc9c3ae63
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d131e54128c23b049350c72a160e8f6a443448de3b4584595088c6dbcf7bcdaa
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9131C232619B8491DAA0DB15F8812AEB7B4FBC4780F105136EACD87B2ADE3DD4558B40
                                                                                                                                                                                                                          Function 00007FF660C3E070 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Initialize
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2538663250-0
                                                                                                                                                                                                                          • Opcode ID: 56cb18ff6626b283ffe465cba34704dc4daad80764cd781178f4e76e5ddfb6ff
                                                                                                                                                                                                                          • Instruction ID: 6f61731904861d92a4e5d453423df2607450a655b6e21c1e22fd81b614b80ca9
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 56cb18ff6626b283ffe465cba34704dc4daad80764cd781178f4e76e5ddfb6ff
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CC21F422A18A41D2EA14DB29E44112EA3B1FFC9784F504535EACD8BBAADF3CD4128B00
                                                                                                                                                                                                                          Function 00007FF660C40D40 Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Ptr_baseRef_count_baseRef_count_base::_std::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1305008675-0
                                                                                                                                                                                                                          • Opcode ID: a63b27ea6810d4f19100fe72ce9d08e0d90dad19ea0bee4daec0c1428a8f0f12
                                                                                                                                                                                                                          • Instruction ID: 7f027abfc7b7e39a86090c14e784fc8a0d08dda720c16d4d839ee53905e895a1
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a63b27ea6810d4f19100fe72ce9d08e0d90dad19ea0bee4daec0c1428a8f0f12
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9531A132618B85D2E650AB15F4913AAB7B4FB85780F100536EACE8BB6ADF3CD4548B40
                                                                                                                                                                                                                          Function 00007FF660CB0240 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                          • Opcode ID: bbdd6f4acd2c37f0f0cea18607fb670f7e5b7d0a06c147e43de415a555d17051
                                                                                                                                                                                                                          • Instruction ID: 9fcbac159d62b0d02d3aa75b6d7e534b210a4dc24424d07e83989e63e508aa38
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bbdd6f4acd2c37f0f0cea18607fb670f7e5b7d0a06c147e43de415a555d17051
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E117222A1C681D2EA649F59D51127EA370FF84B80F684431EA8D9F796CF7DD9418740
                                                                                                                                                                                                                          Function 00007FF660CD0B14 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3215553584-0
                                                                                                                                                                                                                          • Opcode ID: e48b0f802f846f83354f8bcc0381103829573c63fa65d85b6fc9dff923b52bf1
                                                                                                                                                                                                                          • Instruction ID: 8b8c79486ed680083de72facd41f94a77db6bc3488fd61f3bfd9dba579354621
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e48b0f802f846f83354f8bcc0381103829573c63fa65d85b6fc9dff923b52bf1
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DC213D32618A82E7DB619F28D48076976B1EF84B98F684235EA5D8A7D9DF3DD400CB00
                                                                                                                                                                                                                          Function 00007FF660A8EC10 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 162856716-0
                                                                                                                                                                                                                          • Opcode ID: 145833bba5ca1ce280696b75321ad9eaa451110c6ab1e08f0621cc6054542161
                                                                                                                                                                                                                          • Instruction ID: 1819c0348b07e804e8eede70c76a838d5f0f59187dec6f0f84d840998b1e8bd6
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 145833bba5ca1ce280696b75321ad9eaa451110c6ab1e08f0621cc6054542161
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F0214C33528A81E2D640DB15E44126EB7B0FBC5780F504136F68D87BAADF3CC511CB40
                                                                                                                                                                                                                          Function 00007FF660B2B530 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 162856716-0
                                                                                                                                                                                                                          • Opcode ID: df30e030ffef906ebd406c4386cf2156dec33eaf73e67ac5c51d191eca6b075a
                                                                                                                                                                                                                          • Instruction ID: 1c0f3227392237ef92e12b52f08735725c25ddd30453ba8b1fede47a25ad3ac2
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: df30e030ffef906ebd406c4386cf2156dec33eaf73e67ac5c51d191eca6b075a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9F212C32528A85E2D650DB15E49126EB7B4FBC5780F505136FA8E8BBAADF3DC511CB00
                                                                                                                                                                                                                          Function 00007FF660AC5230 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: std::bad_exception::bad_exception
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2160870905-0
                                                                                                                                                                                                                          • Opcode ID: 9601acae6cb39ff66559dabe8f689e5facecc3beb823428337996a1a3a9a380e
                                                                                                                                                                                                                          • Instruction ID: 5123913a624693b87bf6dff48641945098df088328872de29c369ec37ab94933
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9601acae6cb39ff66559dabe8f689e5facecc3beb823428337996a1a3a9a380e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8F110A22A1DB85D6EA10DB59E09176AA770FBC57D4F000435EA8D4BB5ADEBCC0548B44
                                                                                                                                                                                                                          Function 00007FF660B46310 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 162856716-0
                                                                                                                                                                                                                          • Opcode ID: 0d456a3b91fde83b23093f6a813340eb6d1963a1348a2a8896281108e4032113
                                                                                                                                                                                                                          • Instruction ID: 90b9adb700631b7b405dcb73b09f86f2e1af5210f10c5fd0dd6823a8e3858d04
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0d456a3b91fde83b23093f6a813340eb6d1963a1348a2a8896281108e4032113
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A9112B32529B85E2D600DB11E4512AEB771FBC9B80F504036F68E8B7AADF3DD500CB00
                                                                                                                                                                                                                          Function 00007FF660B463D0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 162856716-0
                                                                                                                                                                                                                          • Opcode ID: c2ce1612b05d737af0fc59f78e2927c3cc1f127d700df533a34d98ad139f7e3a
                                                                                                                                                                                                                          • Instruction ID: 0832d8807cf195dafae536967c2e4b8d45c2b3ae93e7dcac0078d5d928bf5ac4
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c2ce1612b05d737af0fc59f78e2927c3cc1f127d700df533a34d98ad139f7e3a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8F113D32529B85E2DA00DB11E4512AEB371FBC5B84F504136F68E8B7AADF3DD500CB00
                                                                                                                                                                                                                          Function 00007FF660C6ED80 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 162856716-0
                                                                                                                                                                                                                          • Opcode ID: f4181ed1da05acdc8d2d48d3bc766bf32e1a299d3035da70120ae7013ea3f35a
                                                                                                                                                                                                                          • Instruction ID: 4cbced5e897e8a556a3004c08f0427e719ee7a9f07b52b06dbea4b03ebea87a0
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f4181ed1da05acdc8d2d48d3bc766bf32e1a299d3035da70120ae7013ea3f35a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 08111932529B84E2D610EB12E8512AAB371FFC5B80F505436F68E8A7A6EF3DD511CB00
                                                                                                                                                                                                                          Function 00007FF660C3FAE0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Ref_count_baseRef_count_base::_std::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1391782822-0
                                                                                                                                                                                                                          • Opcode ID: b0097962b4dfde2aa14eab4b58734fd89c11c4c6999dc842a1ef436c9f199952
                                                                                                                                                                                                                          • Instruction ID: 1a88a7254de85f3546c80f7047c93f186be0d67b71ee08b87da38c055719932f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b0097962b4dfde2aa14eab4b58734fd89c11c4c6999dc842a1ef436c9f199952
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B211A432619B8992D640DB16F45016AB7B5FBC8B80F101536FACD87B6ADF3CD4508B40
                                                                                                                                                                                                                          Function 00007FF660C5CAF0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FreeTask
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 734271698-0
                                                                                                                                                                                                                          • Opcode ID: 1390414adff6cff9572c19d13d4af55dc9366da79f4f2d16f28cb309ed5a3294
                                                                                                                                                                                                                          • Instruction ID: 0d214de49c9e6f1ce0187998426a3a6940cf72e07917376fd7f78d2ba55fb06a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1390414adff6cff9572c19d13d4af55dc9366da79f4f2d16f28cb309ed5a3294
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8611FB7662CA45D6D720DF15E45165AB7B1FBC8788F401231F68D8AA69DF3CE504CF40
                                                                                                                                                                                                                          Function 00007FF660A8B050 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AA2260: stdext::threads::lock_error::lock_error.LIBCPMTD ref: 00007FF660AA2269
                                                                                                                                                                                                                          • _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF660A8B092
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo_noreturnstdext::threads::lock_error::lock_error
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 414106306-0
                                                                                                                                                                                                                          • Opcode ID: d482c9dbe7f8947c5127e3c2cf07479238420b84e503d3de23eadfc201975595
                                                                                                                                                                                                                          • Instruction ID: ab932338b57db9def8e87f7d74da12442ae5756ce8ec99331e85141518ec1c2a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d482c9dbe7f8947c5127e3c2cf07479238420b84e503d3de23eadfc201975595
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 32015262629B86E2D6609B29E44131FA3B0FF847E8F000330E5ED86BD6DF2CC5108704
                                                                                                                                                                                                                          Function 00007FF660A94F80 Relevance: 1.5, APIs: 1, Instructions: 34stringCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ByteCharMultiWidestrrchr
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 276481755-0
                                                                                                                                                                                                                          • Opcode ID: 61311b388f447272e06331baca643fbe0d43bc75db73e1357b66dad9377b3dc1
                                                                                                                                                                                                                          • Instruction ID: 954b908d493582af201eb2b8de21d4446039a3baf674ef802edd540bcddc8d0f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 61311b388f447272e06331baca643fbe0d43bc75db73e1357b66dad9377b3dc1
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2201A836A1C641D6D620DB15E44166AB7B0F7C9788F100235E68D8BB9ACF3ED9408F40
                                                                                                                                                                                                                          Function 00007FF660C55DD0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660C55DED
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B05CE0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B05CF1
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1865873047-0
                                                                                                                                                                                                                          • Opcode ID: f53a0104ca1699a1dff8dd9072ce108e638b513950ee8d3201b6f48fb5c4f35b
                                                                                                                                                                                                                          • Instruction ID: 44b4a0379892302f7b57b2215bf1c45d44948afbeda39d3a679102422b12c6d7
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f53a0104ca1699a1dff8dd9072ce108e638b513950ee8d3201b6f48fb5c4f35b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 13013076608B84D6CB10DF1AE49121ABB70F7C9B85F508126EB8D87B28CF79D5518B40
                                                                                                                                                                                                                          Function 00007FF660B2FFE0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Name$NodeNode::
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2544435820-0
                                                                                                                                                                                                                          • Opcode ID: c5eb3d4471621ccbc52861cf316ed1686c60dd9bf9f3c63ff2dc3039ce938ba5
                                                                                                                                                                                                                          • Instruction ID: cf215fde76ad426b031c98967050425444d463278481f40cd941dc34e47e1064
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c5eb3d4471621ccbc52861cf316ed1686c60dd9bf9f3c63ff2dc3039ce938ba5
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E901D772508A85D3DA14DB15E45026EB370FBC9784F604532EB8E87B69CF7DC901CB00
                                                                                                                                                                                                                          Function 00007FF660AFC410 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: atomic
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1039557753-0
                                                                                                                                                                                                                          • Opcode ID: 9ca185a43521d589ea1ec58c1bf6d9d8244aa92ec9fc2ff649280413e46ebf07
                                                                                                                                                                                                                          • Instruction ID: 00aeb20b7fb766fc79e0a043ff29d4a7e0e75c5ee49b1821a87b94a92bde0a81
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9ca185a43521d589ea1ec58c1bf6d9d8244aa92ec9fc2ff649280413e46ebf07
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 73F02C27629E85D2CA60EF21E08005FB375FBC9B94B505222FA8E47B29DF28C5408B00
                                                                                                                                                                                                                          Function 00007FF660B0D800 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FromMonitorPoint
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1566494148-0
                                                                                                                                                                                                                          • Opcode ID: 9c796e21bcbbd32d9733918cfdc4da3585dd35d9ebd39644cbc39d00fd814335
                                                                                                                                                                                                                          • Instruction ID: ad4e232342e853be9444379f90195807a0319b16cb1ac0206dc562fd28c945fa
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9c796e21bcbbd32d9733918cfdc4da3585dd35d9ebd39644cbc39d00fd814335
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D8F06D32928E8586D312DF24E45025BF7B1FFCA784F105222F28E5AA19DF3DC4868F40
                                                                                                                                                                                                                          Function 00007FF660B05FA0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • SHQueryRecycleBinW.SHELL32(?,?,?,?,?,?,?,?,?,?,00007FF660C52639), ref: 00007FF660B05FCC
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: QueryRecycle
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2469249176-0
                                                                                                                                                                                                                          • Opcode ID: 934cc2852b4868eeabf2003547c0e9231da6ab5e154a758072a7bf41caf7e24a
                                                                                                                                                                                                                          • Instruction ID: a9d296f303a3280166bb63d8151ee50d96e3ccf979ae11a6abd29b74cf8cfc2d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 934cc2852b4868eeabf2003547c0e9231da6ab5e154a758072a7bf41caf7e24a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D1F01D2191CA8BE2EA509F10E84036B6371FF96740F909031E54F8AA84DF3DD5099B54
                                                                                                                                                                                                                          Function 00007FF660A90F30 Relevance: 1.5, APIs: 1, Instructions: 21COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • char_traits.LIBCPMTD ref: 00007FF660A90F5D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A8B5D0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A8B609
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A8B5D0: char_traits.LIBCPMTD ref: 00007FF660A8B68C
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: char_traits$Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3215207624-0
                                                                                                                                                                                                                          • Opcode ID: 439046dc0d3d0137d2424e1f1b116a87ab26bfc4525b92261c69718bc40d6492
                                                                                                                                                                                                                          • Instruction ID: e931d1e3f7b52df9c1bf302ff46eaaee253fc0e8e8b3131ee8e1ec6ad023c431
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 439046dc0d3d0137d2424e1f1b116a87ab26bfc4525b92261c69718bc40d6492
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 46E01C6291CA85D1CA10EB15E45106AABB0FBCA7C0F500131EBCC47B6ADE2CC5118B00
                                                                                                                                                                                                                          Function 00007FF660B067B0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: EnumWindows
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1129996299-0
                                                                                                                                                                                                                          • Opcode ID: dbb1f573b530a87190cc711aa1b050e54dc1485b87a9a9082699a202dfc258a2
                                                                                                                                                                                                                          • Instruction ID: 090cc0a3a13f36958c04a820dda711ca1a5702377dd917f6fa24fb9a38aa1071
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dbb1f573b530a87190cc711aa1b050e54dc1485b87a9a9082699a202dfc258a2
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C4F0FE73918645E2DA21DF14E44116EB774FBC4398F400231E68D8AB6ADF7CD649CB00
                                                                                                                                                                                                                          Function 00007FF660A96C30 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Func_classstd::bad_exception::bad_exception
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3621584023-0
                                                                                                                                                                                                                          • Opcode ID: 811ec457467a64cf29189dc53ead4d07727bd2a83de33478318602b153d018cd
                                                                                                                                                                                                                          • Instruction ID: 0f74e0d86b48c36c6639b5007b7039bdac7a2e3ba76a98d6887ae6913ab62d25
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 811ec457467a64cf29189dc53ead4d07727bd2a83de33478318602b153d018cd
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F7E01A23A28B85D6DA10AB21E84102E63B0FBC9BC0F504131EACD8B7A6CF2CC4058A00
                                                                                                                                                                                                                          Function 00007FF660AC51F0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: std::bad_exception::bad_exception
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2160870905-0
                                                                                                                                                                                                                          • Opcode ID: 378930b60c09186e0c0f67021e624062e6a22285b3f326e3715c0ac8b94d4612
                                                                                                                                                                                                                          • Instruction ID: 5f5c13f50174fc1b4bcca716a2ac4b71bba4daffe1f743ec691e777ab970f333
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 378930b60c09186e0c0f67021e624062e6a22285b3f326e3715c0ac8b94d4612
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 36E0B662619A44D1D620DB1AE48006EA3B1FBC87D4F011131FA8D87B2ADE6CC1108B04
                                                                                                                                                                                                                          Function 00007FF660AF9BE0 Relevance: 1.5, APIs: 1, Instructions: 14comCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CreateInstance
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 542301482-0
                                                                                                                                                                                                                          • Opcode ID: 82772c17aba477afe5628f88038786c146a768299862a8ae95623a60e00681d5
                                                                                                                                                                                                                          • Instruction ID: 11c28b995e4e0140e55ecf4d82dcf49dd1869ef90160aee196dc8c618d08d897
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 82772c17aba477afe5628f88038786c146a768299862a8ae95623a60e00681d5
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E5E07E76A08B85D2C610DF55F84105ABBB4FB99794F604526EACC42B28CF7CD565CF40
                                                                                                                                                                                                                          Function 00007FF660B243A0 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • __std_fs_directory_iterator_open.LIBCPMT ref: 00007FF660B243C5
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C875F8: FindClose.KERNEL32(?,?,?,?,?,00007FF660B243CA), ref: 00007FF660C87619
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C875F8: FindFirstFileExW.KERNEL32 ref: 00007FF660C8763B
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Find$CloseFileFirst__std_fs_directory_iterator_open
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3791046848-0
                                                                                                                                                                                                                          • Opcode ID: 85fdb631bab1a170bc59e4487b9b1b9b43ae0330781ff348048b17804e7260d1
                                                                                                                                                                                                                          • Instruction ID: 8ef0c1a864f0b3e652b1f3a223332e56cb6b8faa0b2b068e7bfd48f1a5771f58
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 85fdb631bab1a170bc59e4487b9b1b9b43ae0330781ff348048b17804e7260d1
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 80D09EB6A19B80D1CA44DB12F88104AB774F7D97C0F505425FACD47B29DF3CC1618B40
                                                                                                                                                                                                                          Function 00007FF660A8AF30 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: allocator
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3447690668-0
                                                                                                                                                                                                                          • Opcode ID: dec3b39dd94d1f2ea7fefd5dc669bf3bce3c72644ec74f011e531bc41841e9f6
                                                                                                                                                                                                                          • Instruction ID: 53c23ea8c40ef2a354005b2dabb1c96ff1176d79d4d67a2537892b8a0ff41e31
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dec3b39dd94d1f2ea7fefd5dc669bf3bce3c72644ec74f011e531bc41841e9f6
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BFC0C966A29B84C1CA04EB16F48100A7370F7C8BC0F909421EA8E43B2ADF28C0608B00
                                                                                                                                                                                                                          Function 00007FF660C875B8 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FileFindNext
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2029273394-0
                                                                                                                                                                                                                          • Opcode ID: 065cdcbe97f106e0eade9506be4ef307043f165ef828597f3074fb4363c91a61
                                                                                                                                                                                                                          • Instruction ID: febe975fadb7c8d9bfbff4180a5f21d09fe34ce2fcd19fdc14d46a0ccd5a851c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 065cdcbe97f106e0eade9506be4ef307043f165ef828597f3074fb4363c91a61
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 59C04814F1AA82E2E6692B626C8327612B4AF88710F944531C108C8350EE3CA1E69A22
                                                                                                                                                                                                                          Function 00007FF660CC5AE0 Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660CC0E10: HeapAlloc.KERNEL32 ref: 00007FF660CC0E4E
                                                                                                                                                                                                                          • HeapReAlloc.KERNEL32(?,?,00000000,00007FF660CBA6A3,?,?,?,00007FF660CC01A3,?,?,?,00007FF660CC0099,?,?,?,00007FF660CC047A), ref: 00007FF660CC5B4D
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: AllocHeap
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 4292702814-0
                                                                                                                                                                                                                          • Opcode ID: 61dce8736956544b94dac60210d0e23872c99ec3cff2a24a66a4d69d8b2a67b2
                                                                                                                                                                                                                          • Instruction ID: f5afaf9f4b064c6fcca54f0237cfcd34571a5a361453d526dd2dc4848489e891
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 61dce8736956544b94dac60210d0e23872c99ec3cff2a24a66a4d69d8b2a67b2
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E301FF50B1C647E6FE946B61D96127A55B15F887A0F184631ED1DCE3C2DE3CEC818210
                                                                                                                                                                                                                          Function 00007FF660CC0D5C Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • HeapAlloc.KERNEL32(?,?,00000000,00007FF660CC0BD6,?,?,?,00007FF660CA90F9,?,?,?,?,00007FF660CC0E08), ref: 00007FF660CC0DB1
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: AllocHeap
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 4292702814-0
                                                                                                                                                                                                                          • Opcode ID: 5ad3a28724de0d7eae44d08b4466c8c7512d1d24c667bf16be5eedaba0a8cd6e
                                                                                                                                                                                                                          • Instruction ID: 80d806355d2f894603060196b9bc130f83f4242c92a21cee89792d2afa262609
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5ad3a28724de0d7eae44d08b4466c8c7512d1d24c667bf16be5eedaba0a8cd6e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0DF04498B0A703E1FE696BE698513B552B4AF88B80F280130C90FCE3D2DE3CF4818210
                                                                                                                                                                                                                          Function 00007FF660CC0E10 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: AllocHeap
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 4292702814-0
                                                                                                                                                                                                                          • Opcode ID: 1ab3abee0b0df280f6ea689347e8a0d30cae0e72a40c9bae681347ef5c9e1206
                                                                                                                                                                                                                          • Instruction ID: be7497d56b73ff26d379d5c02ca702c173e87a6b6348448b7b7823f3137ad5ad
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1ab3abee0b0df280f6ea689347e8a0d30cae0e72a40c9bae681347ef5c9e1206
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 83F08C81F8D246E5FE6427A1994127552B09F88BA0F280F38DD6ECE3C2DE3CE4828610
                                                                                                                                                                                                                          Function 00007FF660A9A4A0 Relevance: 1.3, APIs: 1, Instructions: 13COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ByteCharMultiWide
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 626452242-0
                                                                                                                                                                                                                          • Opcode ID: 0b0b72c7a2bbd2b06bfd941d9483a5493affec11b1419866e72d6a85d5fe652c
                                                                                                                                                                                                                          • Instruction ID: b06b4fbf715047e1866ca48bec6d058f3bf17acd716e58bb64713e5ad302ee7c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0b0b72c7a2bbd2b06bfd941d9483a5493affec11b1419866e72d6a85d5fe652c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 36D05E72A08A81C2DB20AB65E41935B6BB1FBC43A8F508234E6D94B7E5DF3DC1458B40
                                                                                                                                                                                                                          Function 00007FF660AF8C10 Relevance: 1.3, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Uninitialize
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3861434553-0
                                                                                                                                                                                                                          • Opcode ID: 63a70c0b2080d31044b73d5fc0420380379576a7f457e1623dfecf2492aaa18f
                                                                                                                                                                                                                          • Instruction ID: c7058fa5372b886b0ca3a4eee048fff80e037c78d5295cded2762b186f07336a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 63a70c0b2080d31044b73d5fc0420380379576a7f457e1623dfecf2492aaa18f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C1B01225D19786D1C5043B75A88B0192230BB99301FB0C030C148002108E3C40AE4B00

                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                          Function 00007FF660B1CB80 Relevance: 28.3, APIs: 7, Strings: 9, Instructions: 321sleepfilenetworkCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$Sleepshared_ptr$FileTick$Char_traitsCountCount64DeleteDownloadtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: %s%s%s%s%s%s%s%s&%s%s%I64u$%ws\%ws$&evt_action=$&evt_src=fa_$&nocache=$&version=$71434D56-1548-ED3D-AEE6-C75AECD93BF0$https://pcapp.store/pixel.gif?guid=$temp_event
                                                                                                                                                                                                                          • API String ID: 2670538149-1165228633
                                                                                                                                                                                                                          • Opcode ID: 6a7b1bdaa69214de8ec3d4d75453a026673270774ccc25014965952e107e6b74
                                                                                                                                                                                                                          • Instruction ID: 9dc2019bfd28a24b3f067201f3b070d5a9cfaa71e091d5550d99f91511e32b35
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6a7b1bdaa69214de8ec3d4d75453a026673270774ccc25014965952e107e6b74
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8502B232619AC1A5DA719B14E8913EBB3B4FBC8780F404136D6CD8AB6AEF3DD554CB40
                                                                                                                                                                                                                          Function 00007FF660CA8CB8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1239891234-0
                                                                                                                                                                                                                          • Opcode ID: eb1eff54664d364fffe93d0073cbebfe185a6b11e3a872ea97b0a0592c0c5c65
                                                                                                                                                                                                                          • Instruction ID: 6d28e1ce6b20b6ad13c25083317c3632da95a87296dca5eb403782d55d54471a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: eb1eff54664d364fffe93d0073cbebfe185a6b11e3a872ea97b0a0592c0c5c65
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4315E32618B82E6EB60CF25E8406AE73B4FF88754F540136EA9D87B99DF38C545CB00
                                                                                                                                                                                                                          Function 00007FF660C868B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: FormatInfoLocaleMessage
                                                                                                                                                                                                                          • String ID: !x-sys-default-locale
                                                                                                                                                                                                                          • API String ID: 4235545615-2729719199
                                                                                                                                                                                                                          • Opcode ID: 86d9eb462d90a40d0ec9a479c1aed245eb1ae8251b0789d64038f46ad7eeabbd
                                                                                                                                                                                                                          • Instruction ID: 89781900f613b8e7054275751d5d69f9815a485e0b5564ebb0469b8ebefb50cd
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 86d9eb462d90a40d0ec9a479c1aed245eb1ae8251b0789d64038f46ad7eeabbd
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1F016D72B18B82E2E7218B12B55077A6BB1FF88794F584135DA8D8FB98CF3CD5458704
                                                                                                                                                                                                                          Function 00007FF660A9A620 Relevance: 1.3, APIs: 1, Instructions: 45memoryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660CA2EFC: AcquireSRWLockExclusive.KERNEL32(?,?,?,00007FF660A9A6BD,?,?,?,?,00007FF660A9A5A9,?,?,?,?,00007FF660A904C3), ref: 00007FF660CA2F0C
                                                                                                                                                                                                                          • GetProcessHeap.KERNEL32(?,?,?,?,00007FF660A9A5A9,?,?,?,?,00007FF660A904C3), ref: 00007FF660A9A65E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660CA2E90: AcquireSRWLockExclusive.KERNEL32(?,?,?,00007FF660A9A6F1,?,?,?,?,00007FF660A9A5A9,?,?,?,?,00007FF660A904C3), ref: 00007FF660CA2EA0
                                                                                                                                                                                                                            • Part of subcall function 00007FF660CA2E90: ReleaseSRWLockExclusive.KERNEL32(?,?,?,00007FF660A9A6F1,?,?,?,?,00007FF660A9A5A9,?,?,?,?,00007FF660A904C3), ref: 00007FF660CA2EE0
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ExclusiveLock$Acquire$HeapProcessRelease
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3865638231-0
                                                                                                                                                                                                                          • Opcode ID: b3d4828d607801fb5b9148d0b2c84bb5f1e36cda9b12cb856594ad563661b6d3
                                                                                                                                                                                                                          • Instruction ID: f3c43c82cddcb15474be190b62e07241359eb8f136a367c06378cddb33e9bcc1
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3d4828d607801fb5b9148d0b2c84bb5f1e36cda9b12cb856594ad563661b6d3
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AB21D879E18E52F2EA41EB29E8515B42771EF54795F900332D90DCE3A2DF3CA985CB01
                                                                                                                                                                                                                          Function 00007FF660C66700 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 439COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                          • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF660C66EE9
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD7E60: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD7EF7
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsFac_nodeFac_node::_shared_ptrstd::_type_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: Caption$Description$HelpLink$HelpTelephone$IdentifyingNumber$InstallDate$InstallLocation$InstallSource$Language$LocalPackage$Name$PackageCache$PackageCode$PackageName$ProductID$RegCompany$RegOwner$SKUNumber$Transforms$URLInfoAbout$URLUpdateInfo$Vendor$Version
                                                                                                                                                                                                                          • API String ID: 2107158585-605506046
                                                                                                                                                                                                                          • Opcode ID: c86c3a1c7c3f71cb965d5185fb9fc326b5758ef4574e3b8a2458d583eee4731e
                                                                                                                                                                                                                          • Instruction ID: 68f078abbe6353bbab3274b2d9be580b187acdc1b609457abff440caea143505
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c86c3a1c7c3f71cb965d5185fb9fc326b5758ef4574e3b8a2458d583eee4731e
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9A32ED3661DAC2F1DA70DB14E4902EEB374FBC5380F805536D68D8AB6ADE6DD648CB40
                                                                                                                                                                                                                          Function 00007FF660B3D0A0 Relevance: 37.1, APIs: 15, Strings: 6, Instructions: 313windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Window$Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$MetricsSystem$AssocChar_traitsCreateDecorator::getErrorExecuteFocusForegroundLastRectShellTableTypestd::ios_base::goodtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: $&eCode=%lu&br=default$C$open$product$showInCurrentBrowser_error
                                                                                                                                                                                                                          • API String ID: 1779610432-685431900
                                                                                                                                                                                                                          • Opcode ID: ab5898921057d5ef6aefc33c646e51305f5e24b972afbc3e4130f09f84f97ca3
                                                                                                                                                                                                                          • Instruction ID: fcdf4117f9079064dfa306cc35e9e6d6f9e56cee9b3dd74dce5777c202a3894a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ab5898921057d5ef6aefc33c646e51305f5e24b972afbc3e4130f09f84f97ca3
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CE02E532619AC2E6D671DB14E4903EAB375FBC9380F405136D68D86BAAEF7DD548CB00
                                                                                                                                                                                                                          Function 00007FF660AE6DF0 Relevance: 30.2, APIs: 16, Strings: 1, Instructions: 430COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Affinity::operator!=Concurrency::details::Hardwareshared_ptr$Lockitstd::_$GetfacetLockit::_Lockit::~_Mpunctstd::locale::_
                                                                                                                                                                                                                          • String ID: 0123456789ABCDEFabcdef-+Xx
                                                                                                                                                                                                                          • API String ID: 2889901185-2799312399
                                                                                                                                                                                                                          • Opcode ID: 432d304fe1b6997aa18e4637ad5b94b336e2412e3285c0f1698c26b15de39032
                                                                                                                                                                                                                          • Instruction ID: 882dd7f744d1e9ee938772dd1c438ae682d5733f74334effb7e6861bdf87d7a2
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 432d304fe1b6997aa18e4637ad5b94b336e2412e3285c0f1698c26b15de39032
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C922292360C6D2D4E6719A15E4903BFBBB0EBC5784F500136E6CECABABDE2CD5419B50
                                                                                                                                                                                                                          Function 00007FF660ADC4E0 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 335timeCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Http$CloseHandle$shared_ptr$Concurrency::details::EmptyOpenQueue::RequestStructuredWorkstd::ios_base::good$Char_traitsConnectCount64ReceiveResponseSendTickTimeoutstype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: GET$WinHTTP 1.0
                                                                                                                                                                                                                          • API String ID: 967572324-1397384856
                                                                                                                                                                                                                          • Opcode ID: d50dde5fb9a595c92f48760e81b49e37946d8f6795f4dabf3ce050d2a5acbf33
                                                                                                                                                                                                                          • Instruction ID: 78c86d579febe0028e4a7ec3f44cbc00931f60b79e013771feb2c2611c2eea4d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d50dde5fb9a595c92f48760e81b49e37946d8f6795f4dabf3ce050d2a5acbf33
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6E127D36609BC595EAB08B15F8843AAB3B4FB88790F504536DACD87B69DF7CD094CB40
                                                                                                                                                                                                                          Function 00007FF660B22C20 Relevance: 28.4, APIs: 9, Strings: 7, Instructions: 388COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90F30: char_traits.LIBCPMTD ref: 00007FF660A90F5D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9B51
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9B8C
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: shared_ptr.LIBCMTD ref: 00007FF660AD9BC8
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A90EAD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9580: shared_ptr.LIBCMTD ref: 00007FF660AD95B3
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9580: shared_ptr.LIBCMTD ref: 00007FF660AD963C
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B22E0E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B1F990: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B1F9B2
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B22F67
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B22FF4
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B2300A
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B2304C
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B22250: Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF660B222BA
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B23090
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B231D9
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD7E60: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD7EF7
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::$EmptyQueue::StructuredWork$shared_ptr$ProcessorProxyRoot::SchedulerVirtualchar_traitstype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: SELECT url, title, visit_count, last_visit_time FROM urls$SELECT url, title, visit_count, last_visit_time/ 1000000 - 11644473600 AS last_visit_time FROM urls WHERE last_visit_time/ 1000000 - 11644473600 > %d ORDER BY last_visit_time DESC$\HRDR_History.sqlite$\Microsoft\Edge\User Data\Default\History$d$localappdata$temp
                                                                                                                                                                                                                          • API String ID: 2671280029-3709265721
                                                                                                                                                                                                                          • Opcode ID: ef4b5245010b55ac2c93b446b3fa896e5ca293644feecf2b07a500c09e59fec0
                                                                                                                                                                                                                          • Instruction ID: ad2e246ef602ace0e754d16bf3a00f2e9548acfbfc78113bf7e3f5e25493b658
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ef4b5245010b55ac2c93b446b3fa896e5ca293644feecf2b07a500c09e59fec0
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7A22B53362DAC1E1DA70AB15E4912EFA374FBC5780F405532E68D86BAAEF2DD544CB40
                                                                                                                                                                                                                          Function 00007FF660B222F0 Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 372COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90F30: char_traits.LIBCPMTD ref: 00007FF660A90F5D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9B51
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9B8C
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9AA0: shared_ptr.LIBCMTD ref: 00007FF660AD9BC8
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A90EAD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9580: shared_ptr.LIBCMTD ref: 00007FF660AD95B3
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD9580: shared_ptr.LIBCMTD ref: 00007FF660AD963C
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B224DE
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B1F990: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B1F9B2
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B22637
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B226C4
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B226DA
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B2271C
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B22250: Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF660B222BA
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B22760
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B228A9
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD7E60: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD7EF7
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::$EmptyQueue::StructuredWork$shared_ptr$ProcessorProxyRoot::SchedulerVirtualchar_traitstype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: SELECT url, title, visit_count, last_visit_time/ 1000000 - 11644473600 AS last_visit_time FROM urls WHERE last_visit_time/ 1000000 - 11644473600 > %d ORDER BY last_visit_time DESC$\Google\Chrome\User Data\Default\History$\HRDR_History.sqlite$d$localappdata$temp
                                                                                                                                                                                                                          • API String ID: 2671280029-3846392236
                                                                                                                                                                                                                          • Opcode ID: de7bdb877df36c1768b918923e62f750cfbf01b08c5b484e4a6b4f7da8ff8270
                                                                                                                                                                                                                          • Instruction ID: 57dc3f7715d352a75d1d447a29f24ef105a7dad0b26e2d8dd2d0eba965eb27ee
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: de7bdb877df36c1768b918923e62f750cfbf01b08c5b484e4a6b4f7da8ff8270
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AB12A63362DAC1E5DA70EB15E4913EAA374FBC5380F405532E68D86BAAEF2DD544CB40
                                                                                                                                                                                                                          Function 00007FF660ABC7FD Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 385COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660ABF2E0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660ABF2EE
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660ABC9E2
                                                                                                                                                                                                                          • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF660ABCA51
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::Work$EmptyQueue::Structured$Base::ContextIdentityQueue
                                                                                                                                                                                                                          • String ID: ":
                                                                                                                                                                                                                          • API String ID: 416282553-3662656813
                                                                                                                                                                                                                          • Opcode ID: 6a7b9d25337c0256520ace18c769387c56f9b1b84de30fc4a6c1f8208a841913
                                                                                                                                                                                                                          • Instruction ID: 81d514520eae17d0596ad00969c3461def7d0a931d56d977e376fc9f86a3c74c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6a7b9d25337c0256520ace18c769387c56f9b1b84de30fc4a6c1f8208a841913
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 84229376609BC995DA70DB16E4953AEB3A1F7C9BC0F404136DA8D87B6ADF3CC0848B44
                                                                                                                                                                                                                          Function 00007FF660B0CF90 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CloseConcurrency::details::EmptyQueue::StructuredWorktype_info::_name_internal_method$Char_traitsOpenQueryValueshared_ptr
                                                                                                                                                                                                                          • String ID: AppParam$Software\PCAppStore$default
                                                                                                                                                                                                                          • API String ID: 569003908-3084650451
                                                                                                                                                                                                                          • Opcode ID: 16319a447cd1565c2ed7458935bad876886affe0102475c72a8a0fe9420f9b28
                                                                                                                                                                                                                          • Instruction ID: 2eb8a4ee0759ce98382faea2702803ec887c22c6b1609748d9333e6d49148d9e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 16319a447cd1565c2ed7458935bad876886affe0102475c72a8a0fe9420f9b28
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8271E73261DAC1E5DA609B10E4913EBB374FBC5780F405536E6CD8ABAADF2DD548CB40
                                                                                                                                                                                                                          Function 00007FF660ACCF40 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 186COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A90EAD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660ACA780: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660ACA7F8
                                                                                                                                                                                                                          • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF660ACCFEB
                                                                                                                                                                                                                          • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF660ACD0A4
                                                                                                                                                                                                                          • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF660ACD121
                                                                                                                                                                                                                          • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF660ACD19E
                                                                                                                                                                                                                          • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF660ACD1E9
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AB7980: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660AB7AE1
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Fac_nodeFac_node::_std::_$Concurrency::details::EmptyQueue::StructuredWork$Concurrency::details::_SchedulerScheduler::_swap
                                                                                                                                                                                                                          • String ID: last_visit$title$url$visit_count
                                                                                                                                                                                                                          • API String ID: 3419026931-3535738862
                                                                                                                                                                                                                          • Opcode ID: 6c1546871798c304ed637bf94ec2ec67f02618bd18234d1640e87589197c6ee7
                                                                                                                                                                                                                          • Instruction ID: 6647c65c24b6d15bf2320080d033d9125b4c685818386cea31a5206c96a74b48
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6c1546871798c304ed637bf94ec2ec67f02618bd18234d1640e87589197c6ee7
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5C81112261DAC5E5DA60DB11E4953EBA375FBD57C0F805032E68D87BAADE7CC605CB00
                                                                                                                                                                                                                          Function 00007FF660B3CCD0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 173windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • ShellExecuteW.SHELL32 ref: 00007FF660B3CD39
                                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00007FF660B3CD4F
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660A90551
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9190
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B3D0A0: ShellExecuteW.SHELL32 ref: 00007FF660B3D144
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B3D0A0: GetLastError.KERNEL32 ref: 00007FF660B3D160
                                                                                                                                                                                                                          • SetForegroundWindow.USER32 ref: 00007FF660B3D05F
                                                                                                                                                                                                                          • SetFocus.USER32 ref: 00007FF660B3D06A
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$ErrorExecuteLastShell$Char_traitsDecorator::getFocusForegroundTableTypeWindowtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: $&eCode=%lu&br=%ws$open$product$showInCurrentBrowser_error
                                                                                                                                                                                                                          • API String ID: 376287392-1600046415
                                                                                                                                                                                                                          • Opcode ID: 0ec40f3667d32b23dc786af02bfa26687c8bc919dbebf215d3e11f8ec5a40f99
                                                                                                                                                                                                                          • Instruction ID: 155d536b15658f6f1a1d871b473b89fc20c4232e2ce05005cd6cf0b28adb044d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0ec40f3667d32b23dc786af02bfa26687c8bc919dbebf215d3e11f8ec5a40f99
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3E91C53261DAC2E5DA609B10E4913EAB374FBC9780F405536E6CD8AB6ADF7DD548CB00
                                                                                                                                                                                                                          Function 00007FF660B04280 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: type_info::_name_internal_method$ApisConcurrency::details::Concurrency::task_continuation_context::task_continuation_contextEmptyFac_nodeFac_node::_FileListQueue::StructuredWork__std_fs_code_pagestd::_
                                                                                                                                                                                                                          • String ID: ", "$: "
                                                                                                                                                                                                                          • API String ID: 576797101-747220369
                                                                                                                                                                                                                          • Opcode ID: 3d92b305b66c7e4e692d7b894a97cfac0fa49972de7db1859abd241e97e20ec0
                                                                                                                                                                                                                          • Instruction ID: 78a24df7f7850342286a21650b83d8091694640856df07e4fb1a719479389c6e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3d92b305b66c7e4e692d7b894a97cfac0fa49972de7db1859abd241e97e20ec0
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 46610D6261CAC5A1DA60EB11E4513EFA370FBD4784F805532E68E8BBAADE7CD505CB40
                                                                                                                                                                                                                          Function 00007FF660A92C70 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 52COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Yarn$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
                                                                                                                                                                                                                          • String ID: bad locale name
                                                                                                                                                                                                                          • API String ID: 3904239083-1405518554
                                                                                                                                                                                                                          • Opcode ID: c8096dea473fa920a14d580e4e777e2a6771f5c3d34b2eb5396def71f0eaedc1
                                                                                                                                                                                                                          • Instruction ID: f069a41ecdaa8eed08ea6f78e6b8bed62feda75128a99e54fb4df1404a6518b7
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c8096dea473fa920a14d580e4e777e2a6771f5c3d34b2eb5396def71f0eaedc1
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2F113D22B19B46D6DE04EB2AE44156E5370EF837C4F600431EA8D5BB67CE3DD4118708
                                                                                                                                                                                                                          Function 00007FF660CAA2DC Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                          • String ID: f$f$p$p$f
                                                                                                                                                                                                                          • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                          • Opcode ID: a5229d74a4eaf89927f07ca804cc49776dcd8313f5dfff05138c8dc7f1d64a09
                                                                                                                                                                                                                          • Instruction ID: 227c9b469c5054769231486d128a60827966ef0738ccca9369093c84909c7f75
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a5229d74a4eaf89927f07ca804cc49776dcd8313f5dfff05138c8dc7f1d64a09
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BF127262E0C183E7FB649A15D1546BA76B1FFD0754FA84135E68A8ABC4DF3CE880DB10
                                                                                                                                                                                                                          Function 00007FF660AB6570 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 174COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: shared_ptr$Decorator::getTableType
                                                                                                                                                                                                                          • String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$d
                                                                                                                                                                                                                          • API String ID: 2700986858-2578503166
                                                                                                                                                                                                                          • Opcode ID: f9e62e1ae7e7a222a7d2ee48bc335ca8d4ca65c1c1fa9ae57416f9c4ff32b1e2
                                                                                                                                                                                                                          • Instruction ID: 3892f7c119e71cf901c4f7ac50067183d6c95b5520636c1d0c4e1aed154ff28b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f9e62e1ae7e7a222a7d2ee48bc335ca8d4ca65c1c1fa9ae57416f9c4ff32b1e2
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CA810B23A1CAC5D5D660DB15E4513ABBBB1EBD9780F004135E6CE8BBAADF2CD544CB40
                                                                                                                                                                                                                          Function 00007FF660AB6270 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 167COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: shared_ptr$Decorator::getTableType
                                                                                                                                                                                                                          • String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$d
                                                                                                                                                                                                                          • API String ID: 2700986858-2578503166
                                                                                                                                                                                                                          • Opcode ID: 479c40cd136e5cb8a8012c26d6165a2df249509644b901515c6c1fd7aca153a5
                                                                                                                                                                                                                          • Instruction ID: fb22013e838908b1fa852d7c2d51e8591ccf4e7db3e1300f34a6a740838d1552
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 479c40cd136e5cb8a8012c26d6165a2df249509644b901515c6c1fd7aca153a5
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EE813B23A1DAC5D5D660DB25E4512ABBBB1EBDA780F004131E6CE8BB6ADF2CD444CB40
                                                                                                                                                                                                                          Function 00007FF660B06B40 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::Decorator::getEmptyQueue::StructuredTableTypeWork$Concurrency::task_continuation_context::task_continuation_contextbool_std::ios_base::good
                                                                                                                                                                                                                          • String ID: %5D=$s%5B
                                                                                                                                                                                                                          • API String ID: 2106438023-2722900981
                                                                                                                                                                                                                          • Opcode ID: 30185837c31f611c346255d2079aceefcf25eb75f45aaf82a75205d5218d50e7
                                                                                                                                                                                                                          • Instruction ID: e324a3951c4ac21236a3fedd9c7b37676fc8ab950abe390139ed5e231bed8f9c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 30185837c31f611c346255d2079aceefcf25eb75f45aaf82a75205d5218d50e7
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C8311D6362DA82E1DA50EB11E4411AAA370FFD57C0F505432F6CECBBAADE2DD508CB40
                                                                                                                                                                                                                          Function 00007FF660AB6890 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 165COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: shared_ptr$Decorator::getTableType
                                                                                                                                                                                                                          • String ID: d
                                                                                                                                                                                                                          • API String ID: 2700986858-2564639436
                                                                                                                                                                                                                          • Opcode ID: 2a443e44136db3e59683da2a643cd3e0ef56bc8aca3d512dfd3e58115b0b619b
                                                                                                                                                                                                                          • Instruction ID: 780c2663b98de7d4caaee370eb1652963bb13890b105f46bec5e1e83b7502577
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2a443e44136db3e59683da2a643cd3e0ef56bc8aca3d512dfd3e58115b0b619b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A4810A23A1DB85D5D660DB25E4912ABB7B1EBD97C0F004135E68E8BB6ADF3CD444CB40
                                                                                                                                                                                                                          Function 00007FF660C58BE0 Relevance: 12.2, APIs: 8, Instructions: 233COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: allocator
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3447690668-0
                                                                                                                                                                                                                          • Opcode ID: 36a7d94fe0d72bb2d11dd43c1fe2a5c21703dc949e93bb453b0e81e27999111b
                                                                                                                                                                                                                          • Instruction ID: 9d1a988afd3b70ea591ee5d4a6c62bd280260edd9a489b25d24a315abdd8db90
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 36a7d94fe0d72bb2d11dd43c1fe2a5c21703dc949e93bb453b0e81e27999111b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E3B14D3A61DB85D1DA708B16F48066BA3B0FBC9784F500136EACD9BBA9DF3CD5548B40
                                                                                                                                                                                                                          Function 00007FF660AF0E90 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 488COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Func_class
                                                                                                                                                                                                                          • String ID: array$object$object key$object separator$value
                                                                                                                                                                                                                          • API String ID: 1670654298-2448007618
                                                                                                                                                                                                                          • Opcode ID: 7e87fd77274a521ca8a168015b1351c09e933640632d342c78326851afa799f0
                                                                                                                                                                                                                          • Instruction ID: d49459ffdce7e80d6128d47299aa5054642b4724597b511d81dbb360076ab73d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7e87fd77274a521ca8a168015b1351c09e933640632d342c78326851afa799f0
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D942046261DBC1E5DAB19B15E4902EEB3B8EBC5784F404136E6CD8BB6ADF2CD540CB40
                                                                                                                                                                                                                          Function 00007FF660AAABA0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 238COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • OpenEventW.KERNEL32 ref: 00007FF660AAB15E
                                                                                                                                                                                                                          • SetEvent.KERNEL32 ref: 00007FF660AAB184
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9190
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B126B0: RegCreateKeyW.ADVAPI32 ref: 00007FF660B126ED
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B126B0: RegSetKeyValueW.ADVAPI32 ref: 00007FF660B1275A
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B126B0: RegCloseKey.ADVAPI32 ref: 00007FF660B12769
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B126B0: RegCloseKey.ADVAPI32 ref: 00007FF660B127A4
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$CloseEvent$Char_traitsCreateOpenValuetype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: DEBUGSCREEN_EVENT$LastID$LastTime$LastTimeContextual
                                                                                                                                                                                                                          • API String ID: 2367785588-2236634864
                                                                                                                                                                                                                          • Opcode ID: 3ce2d9afb073365b5b2f0e637a284b8937ae83dfabe1f877514e9e59f2989e3a
                                                                                                                                                                                                                          • Instruction ID: 2d094fc0e7a4af8f1981da5897d861d846fbff9bbe83893242c8185312d174db
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ce2d9afb073365b5b2f0e637a284b8937ae83dfabe1f877514e9e59f2989e3a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4DE19036619BC1E4DAB19B15E4803EBB3B4FBC9780F405236DACC86B6ADF29D554CB40
                                                                                                                                                                                                                          Function 00007FF660B265B0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 224COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • DNameNode::DNameNode.LIBCMTD ref: 00007FF660B265C9
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B27B60: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660B27B7F
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B27B90: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660B27BAF
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9190
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B27BC0: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660B27BDF
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B27C20: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660B27CC8
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B27BF0: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660B27C0F
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Decorator::getTableType$Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Name$Char_traitsNodeNode::type_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: %ws&%ws$GET$HTTP/1.1$WinSock2$evt_type=winsock2
                                                                                                                                                                                                                          • API String ID: 2609566735-818248143
                                                                                                                                                                                                                          • Opcode ID: 706562ef86ef595275b084dd7b1f993f8d1c84339223fb974599be1cb61dbcd2
                                                                                                                                                                                                                          • Instruction ID: 767d1d234c3f2542b078a8738395ec4f03ab406c3ae7951ac9c78b3bc7b07496
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 706562ef86ef595275b084dd7b1f993f8d1c84339223fb974599be1cb61dbcd2
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 80C1C13261DAC1E1DA70AB15E4912EBB3B4FBC9780F405136DACD8BB6ADE2DC554CB00
                                                                                                                                                                                                                          Function 00007FF660C35010 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: List
                                                                                                                                                                                                                          • String ID: product$system_panel_not_found
                                                                                                                                                                                                                          • API String ID: 3841611558-2697177965
                                                                                                                                                                                                                          • Opcode ID: a48a8a07d704172fb17cc181777221e0114307349edb0d569b5de80619469948
                                                                                                                                                                                                                          • Instruction ID: 89ec4147078fe48a9b3c700dc31dcc3f6e534d942dbd7dbc55a8185a4dd8b5ba
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a48a8a07d704172fb17cc181777221e0114307349edb0d569b5de80619469948
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AFB1E63261DBC5A1DA609B15E4913EAB3B0FBC9780F405036E6CD8BBAADF6CD545CB40
                                                                                                                                                                                                                          Function 00007FF660ACC1B0 Relevance: 10.7, APIs: 7, Instructions: 175COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AA28C0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AA28D3
                                                                                                                                                                                                                          • bool_.LIBCPMTD ref: 00007FF660ACC20C
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660ACC27F
                                                                                                                                                                                                                            • Part of subcall function 00007FF660ACDB80: std::ios_base::good.LIBCPMTD ref: 00007FF660ACDBA3
                                                                                                                                                                                                                            • Part of subcall function 00007FF660ACDB80: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF660ACDBB9
                                                                                                                                                                                                                            • Part of subcall function 00007FF660ACDB80: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660ACDBCF
                                                                                                                                                                                                                            • Part of subcall function 00007FF660ACDB80: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660ACDC3B
                                                                                                                                                                                                                            • Part of subcall function 00007FF660ACDB80: std::ios_base::good.LIBCPMTD ref: 00007FF660ACDC74
                                                                                                                                                                                                                          • std::ios_base::good.LIBCPMTD ref: 00007FF660ACC2F9
                                                                                                                                                                                                                          • Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF660ACC30C
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660ACC31C
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660ACC3C9
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660ACC438
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Decorator::getTableType$Concurrency::details::EmptyQueue::StructuredWorkstd::ios_base::good$Concurrency::task_continuation_context::task_continuation_context$bool_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2741670149-0
                                                                                                                                                                                                                          • Opcode ID: f8686973c8125cc12799aff30a706b453d9d5dd30fec1e2e1628871db98e9ea0
                                                                                                                                                                                                                          • Instruction ID: 93f237e1258bdeef14a879c27edd6351fe305c023e36a5582eb807258ee416b1
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8686973c8125cc12799aff30a706b453d9d5dd30fec1e2e1628871db98e9ea0
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C281F12365D582F6EA10EB54E4512EAA370FBD1380F415432F28ECB7ABDE6DD909CB40
                                                                                                                                                                                                                          Function 00007FF660AB5042 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 147COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Mailbox
                                                                                                                                                                                                                          • String ID: 5
                                                                                                                                                                                                                          • API String ID: 1763892119-2226203566
                                                                                                                                                                                                                          • Opcode ID: 886b7c52767595658aa0fd33b3f383513ea2a8cba9d0436adf2291bfa191cdc6
                                                                                                                                                                                                                          • Instruction ID: 91253d6f4b6e46ce39f995563bdac0f8816082948ab62f2539ea1ca7491c1e45
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 886b7c52767595658aa0fd33b3f383513ea2a8cba9d0436adf2291bfa191cdc6
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A1613C3260CAC995DA60DA19E4503ABA7A0F7C97D4F400236EBCD87BA9DF6CC645CB00
                                                                                                                                                                                                                          Function 00007FF660C36660 Relevance: 10.6, APIs: 7, Instructions: 118sleepwindowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: CompatibleCreateListObject$BitmapDeleteReleaseSelectSleep
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1446415516-0
                                                                                                                                                                                                                          • Opcode ID: 32ee0b46500626f0da7ec548e29395de13ae04f49fba90d89cdb007a3d861a92
                                                                                                                                                                                                                          • Instruction ID: 98a1f920c917ba3b84b38d457b1533221ab95b95b87fd6ef637d2ca9f1d9388b
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 32ee0b46500626f0da7ec548e29395de13ae04f49fba90d89cdb007a3d861a92
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6851E936619F85D1EA60DB15E4907AEA7B0FBC8B94F504135DA8E87BA8DF3CD845CB00
                                                                                                                                                                                                                          Function 00007FF660AA4410 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660AA4443
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660A90551
                                                                                                                                                                                                                          • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660AA44D2
                                                                                                                                                                                                                            • Part of subcall function 00007FF660C53F40: AppendMenuW.USER32 ref: 00007FF660C54247
                                                                                                                                                                                                                          • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660AA4583
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::_SchedulerScheduler::_$AppendDecorator::getMenuTableType
                                                                                                                                                                                                                          • String ID: Exit$My Account$Settings
                                                                                                                                                                                                                          • API String ID: 3946477610-1629594250
                                                                                                                                                                                                                          • Opcode ID: 2ea314fc7ace830770251565a5868188ea6352921d69b6b85220098b8f19f5c0
                                                                                                                                                                                                                          • Instruction ID: 6d7c84a220db5a24db3f7c216cf55252cde99340d35f35c220f786f9351c6786
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2ea314fc7ace830770251565a5868188ea6352921d69b6b85220098b8f19f5c0
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 11410F36619A86A5EA609B15E48079BB3B0FBC5780F405136EBCD8BB6ADF3CC554CB00
                                                                                                                                                                                                                          Function 00007FF660CC09FC Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,00000001,00007FF660CAFE31,?,?,?,?,?,?,?,?,00007FF660CA8BFE,?,?,?), ref: 00007FF660CC0A0B
                                                                                                                                                                                                                          • FlsGetValue.KERNEL32(?,?,00000001,00007FF660CAFE31,?,?,?,?,?,?,?,?,00007FF660CA8BFE,?,?,?), ref: 00007FF660CC0A20
                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,00000001,00007FF660CAFE31,?,?,?,?,?,?,?,?,00007FF660CA8BFE,?,?,?), ref: 00007FF660CC0A41
                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,00000001,00007FF660CAFE31,?,?,?,?,?,?,?,?,00007FF660CA8BFE,?,?,?), ref: 00007FF660CC0A6E
                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,00000001,00007FF660CAFE31,?,?,?,?,?,?,?,?,00007FF660CA8BFE,?,?,?), ref: 00007FF660CC0A7F
                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,00000001,00007FF660CAFE31,?,?,?,?,?,?,?,?,00007FF660CA8BFE,?,?,?), ref: 00007FF660CC0A90
                                                                                                                                                                                                                          • SetLastError.KERNEL32(?,?,00000001,00007FF660CAFE31,?,?,?,?,?,?,?,?,00007FF660CA8BFE,?,?,?), ref: 00007FF660CC0AAB
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                                          • Opcode ID: 877f7e7529951a5fe962d5eaf008cb7e755919cc2dd4325c5171c455dac9ed75
                                                                                                                                                                                                                          • Instruction ID: f806d32462c620adb88b1b89bd4aa2f379cc8315b1c0cff1a9f9f73cb46909fb
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 877f7e7529951a5fe962d5eaf008cb7e755919cc2dd4325c5171c455dac9ed75
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B2214CA4B09342F6FA5967A1E65517962728F44BB0F244734D82ECEBD6DE3CB4415700
                                                                                                                                                                                                                          Function 00007FF660ABC170 Relevance: 9.3, APIs: 6, Instructions: 251COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Decorator::getTableTypebool_shared_ptr$Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2631667939-0
                                                                                                                                                                                                                          • Opcode ID: 969724d9ea8c27d8e7d68fca2cf4f4de6dde0a6b1269542f2cd8f1353a0af2fb
                                                                                                                                                                                                                          • Instruction ID: 055a960b764caa1015265277d4cffd4373316cb16f5f678f9bb7917849699e25
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 969724d9ea8c27d8e7d68fca2cf4f4de6dde0a6b1269542f2cd8f1353a0af2fb
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C6C10D2361CA8AE0DA60DB15E4916EEA374FBC57C0F405532E68D8B7ABDF6CD544CB00
                                                                                                                                                                                                                          Function 00007FF660B18CD0 Relevance: 9.1, APIs: 6, Instructions: 122COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$task$Is_slash_oper::operatorstd::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 486407804-0
                                                                                                                                                                                                                          • Opcode ID: bb53db32546f82d92d363147a9617a1d03cccc331413cda37523311cc3d5db75
                                                                                                                                                                                                                          • Instruction ID: f4d5be63ea2b9cd4f7285c67a34ddf0f0397bab6585209dfeaa6867925e3c525
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bb53db32546f82d92d363147a9617a1d03cccc331413cda37523311cc3d5db75
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7C51FF2261DB85D1DA60DB16E49026EA3B4FBC97C4F108035EECECBBA9DE3DD5458B40
                                                                                                                                                                                                                          Function 00007FF660AD0840 Relevance: 9.1, APIs: 6, Instructions: 109COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWorkallocator
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1755220593-0
                                                                                                                                                                                                                          • Opcode ID: b0bd36a96c2f4c2c263ee2cb34ef02ea68d7f027693ecf5d0632ff105d701230
                                                                                                                                                                                                                          • Instruction ID: 9086caf3f94b78ad5fa6969d058f9a0b8769e0d529569f855148d19927e395e8
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b0bd36a96c2f4c2c263ee2cb34ef02ea68d7f027693ecf5d0632ff105d701230
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F751A226619F89D1DA608B16E49026EB7B4F7C8BC4F504136EECD8BB6ADF2CC1108B40
                                                                                                                                                                                                                          Function 00007FF660C863FC Relevance: 9.1, APIs: 6, Instructions: 94threadCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,00007FF660C81A82,?,?,?,00007FF660A8D659), ref: 00007FF660C8646D
                                                                                                                                                                                                                          • AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF660C81A82,?,?,?,00007FF660A8D659), ref: 00007FF660C8648C
                                                                                                                                                                                                                          • AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF660C81A82,?,?,?,00007FF660A8D659), ref: 00007FF660C864AE
                                                                                                                                                                                                                          • sys_get_time.LIBCPMT ref: 00007FF660C864C9
                                                                                                                                                                                                                          • TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF660C81A82,?,?,?,00007FF660A8D659), ref: 00007FF660C864EF
                                                                                                                                                                                                                          • TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00007FF660C81A82,?,?,?,00007FF660A8D659), ref: 00007FF660C86507
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: AcquireExclusiveLock$CurrentThreadsys_get_time
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 184115430-0
                                                                                                                                                                                                                          • Opcode ID: c59fc74e2d5658a353b51ebe52c1d3597eed8c2644b95b3dcce62e6eea2e3444
                                                                                                                                                                                                                          • Instruction ID: 8ad9dda9230e2824bea9fa6ce907788cc365e7f401338434f8361cf21e39293a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c59fc74e2d5658a353b51ebe52c1d3597eed8c2644b95b3dcce62e6eea2e3444
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6C410332A28A46F6EB64CF24E4542397BB0EF54B44F804035D68D8A799EF3CE895CB04
                                                                                                                                                                                                                          Function 00007FF660CC0B74 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,00007FF660CA90F9,?,?,?,?,00007FF660CC0E08), ref: 00007FF660CC0B83
                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF660CA90F9,?,?,?,?,00007FF660CC0E08), ref: 00007FF660CC0BB9
                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF660CA90F9,?,?,?,?,00007FF660CC0E08), ref: 00007FF660CC0BE6
                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF660CA90F9,?,?,?,?,00007FF660CC0E08), ref: 00007FF660CC0BF7
                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF660CA90F9,?,?,?,?,00007FF660CC0E08), ref: 00007FF660CC0C08
                                                                                                                                                                                                                          • SetLastError.KERNEL32(?,?,?,00007FF660CA90F9,?,?,?,?,00007FF660CC0E08), ref: 00007FF660CC0C23
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Value$ErrorLast
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2506987500-0
                                                                                                                                                                                                                          • Opcode ID: 6e2b04699322a0b5cfd42af5a9a2b6f92e0ba9cae776432ea4546de978c54102
                                                                                                                                                                                                                          • Instruction ID: a6547ff1693131ae1aa867207e72be7af088114c571cca3fb3d12c6e1bee0845
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6e2b04699322a0b5cfd42af5a9a2b6f92e0ba9cae776432ea4546de978c54102
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5D114AA4A0D382E6FA58A761E65517962729F44BB4F240734E93ECFBD6DE7CB8418300
                                                                                                                                                                                                                          Function 00007FF660AC01E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 122COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                          • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF660AC03D8
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_SchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: bh_lv_date$chrome$edge$firefox
                                                                                                                                                                                                                          • API String ID: 3970144725-4160970090
                                                                                                                                                                                                                          • Opcode ID: 9badd69b937bde4db56816607199edf29410b591607e292c1a116fc3154608ff
                                                                                                                                                                                                                          • Instruction ID: a5e6f4f39df50f91311f2ddf4b70b7595d3af27ec9fc70209eed782c312d3230
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9badd69b937bde4db56816607199edf29410b591607e292c1a116fc3154608ff
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0961A232619AC1E5DA609B54E4913EFB374FBC5380F804536E68D8AB6AEF29D548CB40
                                                                                                                                                                                                                          Function 00007FF660ABC96B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • shared_ptr.LIBCMTD ref: 00007FF660ABC97D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AC0E80: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AC0E8E
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660ABC9E2
                                                                                                                                                                                                                          • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF660ABCA51
                                                                                                                                                                                                                          • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF660ABCABF
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660ABCB88
                                                                                                                                                                                                                          • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF660ABCBF7
                                                                                                                                                                                                                          • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF660ABCC65
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660ABCD1C
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::Work$Base::ContextEmptyIdentityQueueQueue::Structured$shared_ptr
                                                                                                                                                                                                                          • String ID: ":
                                                                                                                                                                                                                          • API String ID: 1420614328-3662656813
                                                                                                                                                                                                                          • Opcode ID: 8473d83d3ebdd20010ffa6d884846ecc031746852bc7a06e646e4d13fd1cf8aa
                                                                                                                                                                                                                          • Instruction ID: 3a27d75797eb0795e393444f915fcf36c6b69b9b0db7b31b664877c37ae82065
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8473d83d3ebdd20010ffa6d884846ecc031746852bc7a06e646e4d13fd1cf8aa
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 22419066609BC995DA70DB16E4953AEB3B1FBC9B80F404136DA8D87B6ADF3CC4408B04
                                                                                                                                                                                                                          Function 00007FF660ADCCE0 Relevance: 7.7, APIs: 5, Instructions: 248COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Decorator::getTableTypestd::ios_base::good$Count64Tick
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2303708893-0
                                                                                                                                                                                                                          • Opcode ID: 27a03b2dbf7fc3cae0a6d0f9ccb6143c9721fc24dc4c615e33674755bc98e386
                                                                                                                                                                                                                          • Instruction ID: 5771ac466c5bb91af1a95a851f6c9c1d24300b43fde5a170eb2f678c45390607
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 27a03b2dbf7fc3cae0a6d0f9ccb6143c9721fc24dc4c615e33674755bc98e386
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D9E16E36609FC9A5DAB19B15F8803DEB3A4F789790F404526DACD87B6AEF38C554CB00
                                                                                                                                                                                                                          Function 00007FF660AAC7C0 Relevance: 7.7, APIs: 5, Instructions: 204COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: fpos
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1083263101-0
                                                                                                                                                                                                                          • Opcode ID: 9476c9bc91792789987b66b2f23cc2085d9c935f74b1f1327633b4182b0acec4
                                                                                                                                                                                                                          • Instruction ID: c0e4f7ec657cbd6dbbbb9bd740bb68e1a0d964677b906ab7b5676a65370b6a13
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9476c9bc91792789987b66b2f23cc2085d9c935f74b1f1327633b4182b0acec4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2AA1B82361CA85D6EA70DA19E44136AA7B0F7857D4F240535EADECBBDACF2CD444CB00
                                                                                                                                                                                                                          Function 00007FF660CC2878 Relevance: 7.7, APIs: 5, Instructions: 196COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: _set_statfp
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1156100317-0
                                                                                                                                                                                                                          • Opcode ID: 9adc40d30be0667ea822cfcd186048a49ebbed58f705be398f9b93e066ac2796
                                                                                                                                                                                                                          • Instruction ID: b33282ed7a6aaed97cd0437709a54493b5dc78b99720fe228eea7b5e6a3e1c8e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9adc40d30be0667ea822cfcd186048a49ebbed58f705be398f9b93e066ac2796
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0481C51290CA46EAF6329E35E46037AA770BF55394F146331E94EAE7E4DF3CED819600
                                                                                                                                                                                                                          Function 00007FF660ADA8B0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Decorator::getTableType$shared_ptr$Concurrency::details::EmptyEventOpenQueue::StructuredWork
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2612416502-0
                                                                                                                                                                                                                          • Opcode ID: 132bb4f05331553b23e435c9935aff854f526115cd742e7eb351bcbd426d0ae7
                                                                                                                                                                                                                          • Instruction ID: e0f35dce42755ee56bcd779e46934214ff9d595035bde2ccbdc9660305c2d647
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 132bb4f05331553b23e435c9935aff854f526115cd742e7eb351bcbd426d0ae7
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E0610A36609BC191DA60DB59F4813AFA3B0FBC5BC4F405036EA8D9BB6ADE3DD0158B00
                                                                                                                                                                                                                          Function 00007FF660AA05A0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: MaklocchrMaklocstr$Getvals
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3711477854-0
                                                                                                                                                                                                                          • Opcode ID: 35126cad555b5dc1fa511b002c8bbc579d431f23a8eec9f184935ac2aa235da3
                                                                                                                                                                                                                          • Instruction ID: a888e25a43320a2002b268e95570aec1f7602180fabbfe5683b04e4eaff25162
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 35126cad555b5dc1fa511b002c8bbc579d431f23a8eec9f184935ac2aa235da3
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CB41CA22608AC2D1D670DB16E4507EEA7B0FBC8784F504136EA8D87BAAEF39C545DB40
                                                                                                                                                                                                                          Function 00007FF660AB24E0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: char_traits$Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_value
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3432838598-0
                                                                                                                                                                                                                          • Opcode ID: 89252c91060f7b916b369dd3db67f98d8b24532f12f7bcafce2569f3e248ad43
                                                                                                                                                                                                                          • Instruction ID: cccc49b58aada00fabb5be9b47c31f8b63b7c913348467f6549c2b6ccce1be13
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 89252c91060f7b916b369dd3db67f98d8b24532f12f7bcafce2569f3e248ad43
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 33410A27A1DB85D2DA20EB15E09016EA7B1FBC97C4F101636FA8D87B6ADF2CD5508B40
                                                                                                                                                                                                                          Function 00007FF660AF29B0 Relevance: 7.6, APIs: 5, Instructions: 87COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF660AF29F1
                                                                                                                                                                                                                          • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF660AF2A5B
                                                                                                                                                                                                                          • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF660AF2A82
                                                                                                                                                                                                                          • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF660AF2ABB
                                                                                                                                                                                                                          • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF660AF2AE5
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Affinity::operator!=Concurrency::details::Hardware
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2104388542-0
                                                                                                                                                                                                                          • Opcode ID: d8385314d93121b3063a5f2a95450edc81f565393832bc5af18c111b4efef671
                                                                                                                                                                                                                          • Instruction ID: a51fc4b7aa3f062015487241044e7ae4ab6cf02a1d9aee02ecbaa837881e410e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d8385314d93121b3063a5f2a95450edc81f565393832bc5af18c111b4efef671
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4941C333608A86E1D630EB15E4913EBB374FBD5784F404136E6CD87BAAEE28D555CB40
                                                                                                                                                                                                                          Function 00007FF660C54340 Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Menu$Concurrency::details::_CountCriticalHandleInsertItemLock::_ReentrantRemoveScoped_lockScoped_lock::~_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 623932097-0
                                                                                                                                                                                                                          • Opcode ID: 7da6c1db0bfdd5c7e90c7ef0e1614ce197be3ce8d7751b5bdfab64b8086b31d4
                                                                                                                                                                                                                          • Instruction ID: 5b7d7353b5b48807f214e4ef05e33b982e36e9a2d46b2c5f75ec4e65eb20d247
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7da6c1db0bfdd5c7e90c7ef0e1614ce197be3ce8d7751b5bdfab64b8086b31d4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7431A636A19B85D6D650DB1AE48136EB7B4FBC9B94F104035EA8E87B6ADF3CD4508B00
                                                                                                                                                                                                                          Function 00007FF660B162D0 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: swap
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 630424929-0
                                                                                                                                                                                                                          • Opcode ID: 7363fd58fbb94a73da7d16e4f3e538ffb88fd9edaf861bf44925db98ae644bf9
                                                                                                                                                                                                                          • Instruction ID: 24071106b34bf41c334401ea06c8a7509a4b19274e5e6bcc2e974f1ed067f38d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7363fd58fbb94a73da7d16e4f3e538ffb88fd9edaf861bf44925db98ae644bf9
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C511CC52F296C292DE40DB1AE09516F9360EFC1BC8B406436FA8F4F76BDE2CC4518744
                                                                                                                                                                                                                          Function 00007FF660CC8734 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: _set_statfp
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1156100317-0
                                                                                                                                                                                                                          • Opcode ID: 7783eb11ce6aeccc52dcaec98f4ae3c4f4dee0f9b344835f90093a4934bb58c0
                                                                                                                                                                                                                          • Instruction ID: ac33a8d3ae827f5358e0fcd70c7354debd8b8c7b1bccb04954357ea95ea8c60f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7783eb11ce6aeccc52dcaec98f4ae3c4f4dee0f9b344835f90093a4934bb58c0
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 44110626E0CA03E9F6541124E5457BB04716F543B4F680630FA7ECE7D7AFBCA9444300
                                                                                                                                                                                                                          Function 00007FF660CC0C3C Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • FlsGetValue.KERNEL32(?,?,?,00007FF660CA8C47,?,?,00000000,00007FF660CA8EE2,?,?,?,?,?,00007FF660CA8E6E), ref: 00007FF660CC0C5B
                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF660CA8C47,?,?,00000000,00007FF660CA8EE2,?,?,?,?,?,00007FF660CA8E6E), ref: 00007FF660CC0C7A
                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF660CA8C47,?,?,00000000,00007FF660CA8EE2,?,?,?,?,?,00007FF660CA8E6E), ref: 00007FF660CC0CA2
                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF660CA8C47,?,?,00000000,00007FF660CA8EE2,?,?,?,?,?,00007FF660CA8E6E), ref: 00007FF660CC0CB3
                                                                                                                                                                                                                          • FlsSetValue.KERNEL32(?,?,?,00007FF660CA8C47,?,?,00000000,00007FF660CA8EE2,?,?,?,?,?,00007FF660CA8E6E), ref: 00007FF660CC0CC4
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                                          • Opcode ID: e012d1f0fc226da98b08fa96183952b1416b1304989c7724abd204c002f722bd
                                                                                                                                                                                                                          • Instruction ID: 6e5eb9b16485eda5dce1026082bc60c9225f52d30388fff13b05acd8fb1320ce
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e012d1f0fc226da98b08fa96183952b1416b1304989c7724abd204c002f722bd
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C41104A1F08242E6FA58A766E65217961719F847B0F284335E83EDE7DADE3CF4418701
                                                                                                                                                                                                                          Function 00007FF660B12230 Relevance: 7.6, APIs: 5, Instructions: 50registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Close$Concurrency::details::_CreateCriticalLock::_QueryReentrantScoped_lockScoped_lock::~_Value
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2355983633-0
                                                                                                                                                                                                                          • Opcode ID: b664341390eea32f7eaf1fb9b87576899c23662f92458e02ab7dcc225eb8d7df
                                                                                                                                                                                                                          • Instruction ID: 7e1d49fd08b9d20399ee516b069b1f85ad65839b8b4eed00c85fe5a92102b70d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b664341390eea32f7eaf1fb9b87576899c23662f92458e02ab7dcc225eb8d7df
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C821CE72A19A81D6DA509B15F48126BB7B0FB89780F105036EACE8BB28DF3DD8548B00
                                                                                                                                                                                                                          Function 00007FF660CC0AD0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Value
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3702945584-0
                                                                                                                                                                                                                          • Opcode ID: a90712a97c21c0d449c0227400bbda50314ec9c37b23ccfd698bbaad28ac511f
                                                                                                                                                                                                                          • Instruction ID: d87119a7b7faa9218b8b882758d91feb1b11943bd37c4fb127eaa0a47c0b6e10
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a90712a97c21c0d449c0227400bbda50314ec9c37b23ccfd698bbaad28ac511f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8611E5A0A09203F6F968B7A2E5621B921714F45B74F280734D83ECE3D2DD3CB8418310
                                                                                                                                                                                                                          Function 00007FF660AE0B60 Relevance: 7.5, APIs: 5, Instructions: 40COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: shared_ptr$allocator$Affinity::operator!=Concurrency::details::Hardware
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1053258265-0
                                                                                                                                                                                                                          • Opcode ID: bf900db0225d2997dfbe73a8c34333cd34f5afa503cc0d13a924f7e3f71c0d2a
                                                                                                                                                                                                                          • Instruction ID: 7939f6f496755a697a9f1c428de7da8cbc7c630a664e9a4bcb490fd1a1c8d9b2
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bf900db0225d2997dfbe73a8c34333cd34f5afa503cc0d13a924f7e3f71c0d2a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D011152361CA8591DA60EB16F4802AFA778FBC47C4F408132EACD8BB5ADF7CD5518B40
                                                                                                                                                                                                                          Function 00007FF660A8C570 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 401COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Mpunct$std::ios_base::width
                                                                                                                                                                                                                          • String ID: @
                                                                                                                                                                                                                          • API String ID: 1355946870-2766056989
                                                                                                                                                                                                                          • Opcode ID: d96b744f6c99921833105c33ce9676645dc555913f4d143a5158a76b41565cc6
                                                                                                                                                                                                                          • Instruction ID: 9d1af0bed362ecf1d7087e9bc53b32409ff02e213abb1fce730b5664b98d7295
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d96b744f6c99921833105c33ce9676645dc555913f4d143a5158a76b41565cc6
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3212152660DAC5A5DAB09B15E4943ABA3B1F7C87C0F804532DACD87BAADE3CD545CB40
                                                                                                                                                                                                                          Function 00007FF660AC2F70 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 401COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Mpunct$std::ios_base::width
                                                                                                                                                                                                                          • String ID: @
                                                                                                                                                                                                                          • API String ID: 1355946870-2766056989
                                                                                                                                                                                                                          • Opcode ID: 5cfa6f9de2305cc32525f9e4cdc4674e7f33466df81b1d60614102e7b5b86c7b
                                                                                                                                                                                                                          • Instruction ID: 66552112c397113bfc71b81f244d73271815264315c456ad6573df344b739b57
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5cfa6f9de2305cc32525f9e4cdc4674e7f33466df81b1d60614102e7b5b86c7b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4D12142360DAC595DAB09B15E4943EBA7A1FBC87C0F844036DACD87BAADE3CD545CB40
                                                                                                                                                                                                                          Function 00007FF660CC4768 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                          • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                          • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                          • Opcode ID: cb76a8c633e42a35513abc0c8eba2d28fb341af133972ce7828b83f61b038737
                                                                                                                                                                                                                          • Instruction ID: 302a1a6fe3c182d632e221ef076e5c4d0f407d0319d6b59490facba1e44b5676
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cb76a8c633e42a35513abc0c8eba2d28fb341af133972ce7828b83f61b038737
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 24818A32E08262E5FA748E69C11027A26B5EF12B58F95C035CA0EDF7D9DF3DE9429701
                                                                                                                                                                                                                          Function 00007FF660AB5040 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Mailbox
                                                                                                                                                                                                                          • String ID: 5
                                                                                                                                                                                                                          • API String ID: 1763892119-2226203566
                                                                                                                                                                                                                          • Opcode ID: 87770dd7e9f571f2986278d7a610b280d713e51eb297ed83aa80651aeca5b4b1
                                                                                                                                                                                                                          • Instruction ID: a047b1b3d78367c6991216fc3c323fd68f4c287cc352e5dc005da480c7266e0a
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 87770dd7e9f571f2986278d7a610b280d713e51eb297ed83aa80651aeca5b4b1
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E9514B3260CACA95DA70DA15E4503ABA7A0F7C97D4F440636EACD87BA9DF7CC645CB00
                                                                                                                                                                                                                          Function 00007FF660B0E310 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_type_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: <U+%.4X>
                                                                                                                                                                                                                          • API String ID: 1503085150-1919636860
                                                                                                                                                                                                                          • Opcode ID: b4226c96f80336f2acb137b60caaf3500fe42d3915b98a3ec1c636dd44350f42
                                                                                                                                                                                                                          • Instruction ID: df7f48b0c93b7ce17e1ce76318933466e7f7bc4ddf2b68aee00cd899f6b5b457
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b4226c96f80336f2acb137b60caaf3500fe42d3915b98a3ec1c636dd44350f42
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3E315B2361CA85E5D660DB15E4502AEB7B0FBC9784F504532F6CE8BBAADE2CD544CB40
                                                                                                                                                                                                                          Function 00007FF660CC6984 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetConsoleMode.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00007FF660CD3181), ref: 00007FF660CC6AA0
                                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00007FF660CD3181), ref: 00007FF660CC6B2B
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 953036326-0
                                                                                                                                                                                                                          • Opcode ID: c036e56a59628b86c18341a9c02e7de676271cae1522afdd6599a2391acaaf31
                                                                                                                                                                                                                          • Instruction ID: 774b4054d3cf14af8850f759b814402612c88fec75b59d2c138f1168961e3c32
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c036e56a59628b86c18341a9c02e7de676271cae1522afdd6599a2391acaaf31
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5B91B072E08A52E6F7548B65D5902BD6BB0EF04B88F144139DE4EDBB94DF38D882D700
                                                                                                                                                                                                                          Function 00007FF660AA5000 Relevance: 6.1, APIs: 4, Instructions: 145COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWorkfrexplswprintf
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2911421839-0
                                                                                                                                                                                                                          • Opcode ID: 2e42126a31bf4853d41c0c640862009aec23354457a15abcbf439dd886f10093
                                                                                                                                                                                                                          • Instruction ID: 48da7234eb910de37dda8db512c48160ebc1d88aec60826299f8a4228c4134b9
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2e42126a31bf4853d41c0c640862009aec23354457a15abcbf439dd886f10093
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A071163360DAC59AD6609B25E4503AABBB0EBC5390F204136EBDD87B9ADF2DD544CF40
                                                                                                                                                                                                                          Function 00007FF660AACB70 Relevance: 6.1, APIs: 4, Instructions: 144COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: fpos
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1083263101-0
                                                                                                                                                                                                                          • Opcode ID: 324bcf03c9d9d573fb62d07e462846c406423958ac91c0845e5633d1312c6c31
                                                                                                                                                                                                                          • Instruction ID: ff0918044a979de0de63520a862c8fb2077d5769d2219f2ebe7b743162dd597c
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 324bcf03c9d9d573fb62d07e462846c406423958ac91c0845e5633d1312c6c31
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A561C02361CA81D7E6609A29E45136AA7B4F7C57D4F240635EADDCBBEACF2DD440CB00
                                                                                                                                                                                                                          Function 00007FF660B188F0 Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyIs_slash_oper::operatorQueue::StructuredWorkstd::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 569396444-0
                                                                                                                                                                                                                          • Opcode ID: 87bbc430b2869bc34d2962cd5498185e9f2368d437da48860d56406be183ffe0
                                                                                                                                                                                                                          • Instruction ID: e4634086ae2d1288544fad1d5e36687ffd0c853a152eb3b209750e165592a4a7
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 87bbc430b2869bc34d2962cd5498185e9f2368d437da48860d56406be183ffe0
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CE61292251DA86E1DA50DB15E0903AEB7B0FBC5780F505032FACE8BBAADF6CD545CB00
                                                                                                                                                                                                                          Function 00007FF660B2CC30 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • CancelIo.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF660A97797), ref: 00007FF660B2CC42
                                                                                                                                                                                                                          • bool_.LIBCPMTD ref: 00007FF660B2CC9A
                                                                                                                                                                                                                          • shared_ptr.LIBCMTD ref: 00007FF660B2CCA7
                                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF660A97797), ref: 00007FF660B2CD2A
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B2E400: std::_Throw_Cpp_error.LIBCPMT ref: 00007FF660B2E421
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B2E400: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,00007FF660B2CC72), ref: 00007FF660B2E427
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B2E400: std::_Throw_Cpp_error.LIBCPMT ref: 00007FF660B2E43B
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B2E400: std::_Throw_Cpp_error.LIBCPMT ref: 00007FF660B2E46A
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Cpp_errorThrow_std::_$CancelCloseCurrentHandleThreadbool_shared_ptr
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3093343528-0
                                                                                                                                                                                                                          • Opcode ID: 4ef8de572ed1f1f70c74484de002ab0e309cf2b1b7d2cce3d2da03e174d9b014
                                                                                                                                                                                                                          • Instruction ID: a433bffa7860b2ae7a7dd16185946129a57d4784c78bd2a0aa5bf1f5e5397f41
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4ef8de572ed1f1f70c74484de002ab0e309cf2b1b7d2cce3d2da03e174d9b014
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D0315022A1CB4AD1DA11DB16E08137E67B1FF86BC4F504431E68E8B7A6DF3DE4418740
                                                                                                                                                                                                                          Function 00007FF660AF2800 Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF660AF2886
                                                                                                                                                                                                                          • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF660AF28AD
                                                                                                                                                                                                                          • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF660AF28E3
                                                                                                                                                                                                                          • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF660AF290A
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2443641946-0
                                                                                                                                                                                                                          • Opcode ID: 864e10653a6bb1982f66181eec793958d4befb51fa1d7588dc549e19882c75cf
                                                                                                                                                                                                                          • Instruction ID: 9ba23facd8b07341ead78e21428c4aa283ec4ba36690efbf48bb122292dce311
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 864e10653a6bb1982f66181eec793958d4befb51fa1d7588dc549e19882c75cf
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D641D433508A86A1D660EB15E4912EFB7B4FBC4784F404136E6CD87BAAEF2CD559CB40
                                                                                                                                                                                                                          Function 00007FF660B126B0 Relevance: 6.1, APIs: 4, Instructions: 78registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Close$CreateValue
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1009429713-0
                                                                                                                                                                                                                          • Opcode ID: 2116bf6108d9dbc643e6651f0e087ee6e55b34c77ddc80157fa709f046260e2c
                                                                                                                                                                                                                          • Instruction ID: 209402eebb718fadd3215d60d7114f448b4bf2765be82278e210984d2c8b88e3
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2116bf6108d9dbc643e6651f0e087ee6e55b34c77ddc80157fa709f046260e2c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A7310D2261DA81E2E650EB25E45126FA7B0FBC57C0F105436F6CECBB6ACF6DD4508B00
                                                                                                                                                                                                                          Function 00007FF660ACC214 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660ACC27F
                                                                                                                                                                                                                            • Part of subcall function 00007FF660ACDB80: std::ios_base::good.LIBCPMTD ref: 00007FF660ACDBA3
                                                                                                                                                                                                                            • Part of subcall function 00007FF660ACDB80: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF660ACDBB9
                                                                                                                                                                                                                            • Part of subcall function 00007FF660ACDB80: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660ACDBCF
                                                                                                                                                                                                                            • Part of subcall function 00007FF660ACDB80: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660ACDC3B
                                                                                                                                                                                                                            • Part of subcall function 00007FF660ACDB80: std::ios_base::good.LIBCPMTD ref: 00007FF660ACDC74
                                                                                                                                                                                                                          • std::ios_base::good.LIBCPMTD ref: 00007FF660ACC2F9
                                                                                                                                                                                                                          • Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF660ACC30C
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660ACC31C
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660ACC3C9
                                                                                                                                                                                                                          • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF660ACC438
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Decorator::getTableType$std::ios_base::good$Concurrency::details::Concurrency::task_continuation_context::task_continuation_contextEmptyQueue::StructuredWork
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 372723826-0
                                                                                                                                                                                                                          • Opcode ID: 4b4e1f6c1bd9ab80bb31d829fd0540ce0e8ba7c5978fb96544d6d1d2e2ebe3d7
                                                                                                                                                                                                                          • Instruction ID: 4e7d6808b0cde909d16721848e74197057f2288c68826aa1c5f702c7cf0ab129
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4b4e1f6c1bd9ab80bb31d829fd0540ce0e8ba7c5978fb96544d6d1d2e2ebe3d7
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4E31C02366D542F6EA40EB65E4510BAA770EFD13C0F911432F28ECA7ABDE2DD945CB40
                                                                                                                                                                                                                          Function 00007FF660B3CB90 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: std::ios_base::good$Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1863006881-0
                                                                                                                                                                                                                          • Opcode ID: 749c20c281a9e2f9b96af624646f2169fd129f566b08e980573cde30b5ae49e2
                                                                                                                                                                                                                          • Instruction ID: 2b0b070bc1c2c887563d28d94886bc87dea23acdf469908cfa938844e7cc3e6e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 749c20c281a9e2f9b96af624646f2169fd129f566b08e980573cde30b5ae49e2
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D7311C3252DA85E2D650DB55E4411AAA374FBC9780F505432FACECBB6ADF3DD8148B40
                                                                                                                                                                                                                          Function 00007FF660A901E0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 228209623-0
                                                                                                                                                                                                                          • Opcode ID: 04194f28e6833e5ad93414646c52378b8c9f3babab847230f10546350b249c4d
                                                                                                                                                                                                                          • Instruction ID: 09a025dfce87d3a6712a753066cd974680d904bbcb8b395195b645a4157fc9eb
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 04194f28e6833e5ad93414646c52378b8c9f3babab847230f10546350b249c4d
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2321F22662DA45E1DA50DB15E48066AB7B4FBC47E4F501231FB9D87BBADE3CD540CB00
                                                                                                                                                                                                                          Function 00007FF660AC4550 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 228209623-0
                                                                                                                                                                                                                          • Opcode ID: 698a065eccdd5cff8360574d6f9f3f96b6474269aadfa026fe32a2384a2cb004
                                                                                                                                                                                                                          • Instruction ID: 406e7007b82b400b9e372d5fb9dc13bb5688402470f2dc79834138b5813fe8ac
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 698a065eccdd5cff8360574d6f9f3f96b6474269aadfa026fe32a2384a2cb004
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2E211C2651DE85E1DA50DB19E48026EB7B4FBC47E4F501232FA9E87BAACE3CD540CB00
                                                                                                                                                                                                                          Function 00007FF660AC4660 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 228209623-0
                                                                                                                                                                                                                          • Opcode ID: e7873636dcd14ac59dedf16b5b99672fd79a654e0270afd0469f085aeba638cc
                                                                                                                                                                                                                          • Instruction ID: 27fbcef5db9756404c96fdda3fb8afaf07b609fc2979a3c71fb7664bbb4a3d4d
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e7873636dcd14ac59dedf16b5b99672fd79a654e0270afd0469f085aeba638cc
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 02211C2792CA45E1DA509B15E48026EB7B4FBC47E4F501232FA9E87BBACE3CD550CB04
                                                                                                                                                                                                                          Function 00007FF660AC4770 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 228209623-0
                                                                                                                                                                                                                          • Opcode ID: 1aa68ce42b25ab56e64ebb0db5b2a8bbb5853dc163999b50c0b7da70d2b3275b
                                                                                                                                                                                                                          • Instruction ID: 6972be2666c7d4355cfd1abbc8fcc20a4ca5baca9e493c5f757a8768894a3c96
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1aa68ce42b25ab56e64ebb0db5b2a8bbb5853dc163999b50c0b7da70d2b3275b
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1A211E2791CE85E1DA509B15E48026AB7B4FBC47E4F501231FA9E87BBACE3CD544CB00
                                                                                                                                                                                                                          Function 00007FF660AF2F50 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 228209623-0
                                                                                                                                                                                                                          • Opcode ID: c7f533f3cd8ceea7f501ffdfe908fcb24a898465d195543cf5a4350fd9159aad
                                                                                                                                                                                                                          • Instruction ID: b3b4ad4774ae9b213ef2673cef1f40090ad82775c68159664fffcc912443bd91
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c7f533f3cd8ceea7f501ffdfe908fcb24a898465d195543cf5a4350fd9159aad
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9D21FD2752DA85E1DA509B15E48026AB7B4FBC47E4F501232FA9E87BBADE3CD550CB00
                                                                                                                                                                                                                          Function 00007FF660AF3060 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 228209623-0
                                                                                                                                                                                                                          • Opcode ID: fef7e967672b0f2c09629c368021041c2da60d2af26726eb8e7fee064b808e00
                                                                                                                                                                                                                          • Instruction ID: 0e5bdf091d1bae389758b8052c7c196d7a6e6ad9f5b4fbd622b1d050eab71b4f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fef7e967672b0f2c09629c368021041c2da60d2af26726eb8e7fee064b808e00
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 51213C2751DA85E1DA609B15E48026AB7B4FBC47E4F501232FACE87BAACE3CD540CB00
                                                                                                                                                                                                                          Function 00007FF660AFADC0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ConditionMask$InfoVerifyVersion
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2793162063-0
                                                                                                                                                                                                                          • Opcode ID: ca6a0869207d72d33c9b7a660a3a7bea133d9399d10461ba54ec6bb84780c07d
                                                                                                                                                                                                                          • Instruction ID: 9ecedd8b7dbadb8c7d1f5d2d51339926a97a3b746c91d1fc1af5104f709e3de8
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ca6a0869207d72d33c9b7a660a3a7bea133d9399d10461ba54ec6bb84780c07d
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9F2139765283C086D360CF20E4583ABB7B1FB88754F001039E6898BBA8EB7DC544CF40
                                                                                                                                                                                                                          Function 00007FF660B12150 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Close$CreateDeleteValue
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 1061628661-0
                                                                                                                                                                                                                          • Opcode ID: 2604b7f29dc02218e7eeedd87a770ab52ae1f511f2082dcff51437a05d5820e8
                                                                                                                                                                                                                          • Instruction ID: cb2892475ee12b1032f3828abe521c369714f3d05c4853d38d568e29bcc26a3e
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2604b7f29dc02218e7eeedd87a770ab52ae1f511f2082dcff51437a05d5820e8
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EA21E96261CA81E1DA20EB51E85127FA770FBC97D4F000035FACECAB6ACFADD5548B40
                                                                                                                                                                                                                          Function 00007FF660B2E400 Relevance: 6.0, APIs: 4, Instructions: 46threadCOMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Cpp_errorThrow_std::_$CurrentThread
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 2261580123-0
                                                                                                                                                                                                                          • Opcode ID: 7b953ca83c8c1195baba728f739053b3199d066645e84a6a40952e6c21be98d9
                                                                                                                                                                                                                          • Instruction ID: 88a0352bd383936669a9e728d8b4a431d115adb5824553bfe59f243113bf2c90
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7b953ca83c8c1195baba728f739053b3199d066645e84a6a40952e6c21be98d9
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9D014021B19689A6E740A626E4512BE56B6FBC8780F844035EE9ECB7D6ED3CE941C700
                                                                                                                                                                                                                          Function 00007FF660B04AE0 Relevance: 6.0, APIs: 4, Instructions: 25COMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWorkswap
                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                          • API String ID: 3764174498-0
                                                                                                                                                                                                                          • Opcode ID: 64c375c45fcf1574e63375e0e74c0897d23ff7183afb565a4982bf000894ce30
                                                                                                                                                                                                                          • Instruction ID: 08ef486456161a99ceeb586415abc7d5e7c523f94609e6a68c256dc1cc251820
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 64c375c45fcf1574e63375e0e74c0897d23ff7183afb565a4982bf000894ce30
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B5F0A462A58A8591DA20EB15E45502EA7B0FBC97C8F504535FACD8BB6ACE2DC5518B00
                                                                                                                                                                                                                          Function 00007FF660AA0B10 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 350COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Mpunctstd::ios_base::width
                                                                                                                                                                                                                          • String ID: @
                                                                                                                                                                                                                          • API String ID: 1954291571-2766056989
                                                                                                                                                                                                                          • Opcode ID: e6ddbd80c79b957fee60e298132a2d6cda97317b63a0f88a58f218ede616694f
                                                                                                                                                                                                                          • Instruction ID: 4b3707b5aa6fb831f8b2901950e94ffbb3a2858a42764b9b8e4b6e7638091ab7
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e6ddbd80c79b957fee60e298132a2d6cda97317b63a0f88a58f218ede616694f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2D02353261DAC995DAB09B15E8943EFA3A1F7C87C0F404132DA8D87BAADE7CD545CB40
                                                                                                                                                                                                                          Function 00007FF660A848A0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A910CD
                                                                                                                                                                                                                          • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF660A84DA9
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                                                          • String ID: $@
                                                                                                                                                                                                                          • API String ID: 3399187363-1077428164
                                                                                                                                                                                                                          • Opcode ID: 6c4c99d7dea36f23ea7cd164c65aab3a700cc0d4e4ea01db553fa58f6f5dada5
                                                                                                                                                                                                                          • Instruction ID: cd90cb9b6030fd6bafc2363ea8524d84a2a6c4eb1f1f20523b4643130e1ef033
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6c4c99d7dea36f23ea7cd164c65aab3a700cc0d4e4ea01db553fa58f6f5dada5
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CDD1B072259AC6E5DAB19B05F4903EAB3B4F788380F405136DA8C87B6AEF7DC554CB40
                                                                                                                                                                                                                          Function 00007FF660A82A50 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A910CD
                                                                                                                                                                                                                          • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF660A82F59
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                                                          • String ID: $@
                                                                                                                                                                                                                          • API String ID: 3399187363-1077428164
                                                                                                                                                                                                                          • Opcode ID: 38ed92ba74d5649098e0559f6f5d519662d582d1ce5bd4f766d18dae0d4290e4
                                                                                                                                                                                                                          • Instruction ID: 03490e540e214033dfa19832b83d837a60d9c45b26b521abb757072e89e9c9fa
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 38ed92ba74d5649098e0559f6f5d519662d582d1ce5bd4f766d18dae0d4290e4
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6DD1C132659BC6E5DAB19B04F4903EAB3B4F788384F405136DA8C87B6AEF79C554CB40
                                                                                                                                                                                                                          Function 00007FF660AF0F05 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::cancellation_token::_FromImpl
                                                                                                                                                                                                                          • String ID: object key$object separator
                                                                                                                                                                                                                          • API String ID: 2278334151-2279923633
                                                                                                                                                                                                                          • Opcode ID: f46b7e787fcbf46f295cec9262e28ba246f18b7607bfbb222b1eb3d36f79fe4c
                                                                                                                                                                                                                          • Instruction ID: 363df8e9b5184f400aad31066dc100525efeba9fb0927b29e37e6a49b8366073
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f46b7e787fcbf46f295cec9262e28ba246f18b7607bfbb222b1eb3d36f79fe4c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8BB1D66260DAC5E4DA70AB15E4503EEB3B4EBC9784F404136E6CD8BB9AEF2DD544CB40
                                                                                                                                                                                                                          Function 00007FF660AFA800 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 161COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660A910CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12420: RegCreateKeyW.ADVAPI32 ref: 00007FF660B12470
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12420: strrchr.LIBCMTD ref: 00007FF660B12487
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12420: RegQueryValueExW.ADVAPI32 ref: 00007FF660B124D3
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B12420: RegCloseKey.ADVAPI32 ref: 00007FF660B124ED
                                                                                                                                                                                                                          • std::ios_base::good.LIBCPMTD ref: 00007FF660AFA9E1
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          • Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF660AFA821
                                                                                                                                                                                                                          • Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run, xrefs: 00007FF660AFA888
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseCreateQueryValueshared_ptrstd::ios_base::goodstrrchrtype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run$Software\Microsoft\Windows\CurrentVersion\Run
                                                                                                                                                                                                                          • API String ID: 3056597930-377293507
                                                                                                                                                                                                                          • Opcode ID: 365b49a09c28d45eafb0c7e85deb6d59e6ae4c1ceeb9fefb9e59e351e7c19bf3
                                                                                                                                                                                                                          • Instruction ID: 447f0fea53630a0c3ca85a0fa8fbb5f3584c6c5064c81f39c95f7185764958f9
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 365b49a09c28d45eafb0c7e85deb6d59e6ae4c1ceeb9fefb9e59e351e7c19bf3
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1B81F53261DAC1A5D6709B15E4903EBB7B4FBC9784F404236E6CD8ABAADF2DD544CB00
                                                                                                                                                                                                                          Function 00007FF660CC665C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                          • String ID: U
                                                                                                                                                                                                                          • API String ID: 442123175-4171548499
                                                                                                                                                                                                                          • Opcode ID: f03171edcd5278d2b6f73b2bb024a211342e4400515f9e550b209bc09fe36dfc
                                                                                                                                                                                                                          • Instruction ID: 2f1f912839321e0640f6a6b27d537ee5e8e482d61a63720320c62609187c8b86
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f03171edcd5278d2b6f73b2bb024a211342e4400515f9e550b209bc09fe36dfc
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A541B222A18A81D6EB208F65E5443BA67B0FB88794F544131EE4ECB798EF3CD441C700
                                                                                                                                                                                                                          Function 00007FF660B06940 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B11CD0: Concurrency::cancellation_token::_FromImpl.LIBCPMTD ref: 00007FF660B11CFD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B11CD0: Concurrency::cancellation_token::_FromImpl.LIBCPMTD ref: 00007FF660B11D35
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90F30: char_traits.LIBCPMTD ref: 00007FF660A90F5D
                                                                                                                                                                                                                          • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B06ACE
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::cancellation_token::_FromImpl$Concurrency::details::EmptyQueue::StructuredWorkchar_traits
                                                                                                                                                                                                                          • String ID: parse error$parse_error
                                                                                                                                                                                                                          • API String ID: 3940763495-1820534363
                                                                                                                                                                                                                          • Opcode ID: 0be3776a7a483cc6db7a160186439ac5a551f2d255295488c593d7cff802ba90
                                                                                                                                                                                                                          • Instruction ID: fb5b597414704692084b0be4a576fd0b3dbbbcfa3f0fc45475ad2e05e8d7061f
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0be3776a7a483cc6db7a160186439ac5a551f2d255295488c593d7cff802ba90
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C441B233609AC5E5DAA09B15E4912EAB7B0FBC5380F404132EACD87B6ADF3DD555CB80
                                                                                                                                                                                                                          Function 00007FF660AF86E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00007FF660AF8724
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A90F30: char_traits.LIBCPMTD ref: 00007FF660A90F5D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660B06870: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660B068F8
                                                                                                                                                                                                                            • Part of subcall function 00007FF660CA3DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF660AA227F), ref: 00007FF660CA3DF0
                                                                                                                                                                                                                            • Part of subcall function 00007FF660CA3DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF660AA227F), ref: 00007FF660CA3E31
                                                                                                                                                                                                                          • List.LIBCMTD ref: 00007FF660AF879D
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::Work$Base::ContextEmptyExceptionFileHeaderIdentityListQueueQueue::RaiseStructuredchar_traits
                                                                                                                                                                                                                          • String ID: cannot get value
                                                                                                                                                                                                                          • API String ID: 1878104746-2333289761
                                                                                                                                                                                                                          • Opcode ID: 83623200a6a935e1044661c20c81d400ada703e384f0659d5eebcd658324f36f
                                                                                                                                                                                                                          • Instruction ID: 16f68c9b47eb4c63c9870a80dfc35c6471ed9eb61f051575ad7336497f6a1918
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 83623200a6a935e1044661c20c81d400ada703e384f0659d5eebcd658324f36f
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 45312963A1C686E1EA30A715E0513BA6770EFC13C4F904032D68D8ABABEE6CE545C780
                                                                                                                                                                                                                          Function 00007FF660AFA6B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          • GetUserDefaultUILanguage.KERNEL32 ref: 00007FF660AFA6DE
                                                                                                                                                                                                                          • LCIDToLocaleName.KERNEL32 ref: 00007FF660AFA6FD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660A911A0: _WChar_traits.LIBCPMTD ref: 00007FF660A911CD
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF660AD9930
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD995D
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: shared_ptr.LIBCMTD ref: 00007FF660AD9993
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF660AD9A2E
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F05
                                                                                                                                                                                                                            • Part of subcall function 00007FF660AD8E90: shared_ptr.LIBCMTD ref: 00007FF660AD8F8E
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsDefaultLanguageLocaleNameUsertype_info::_name_internal_method
                                                                                                                                                                                                                          • String ID: unknown
                                                                                                                                                                                                                          • API String ID: 3795742680-2904991687
                                                                                                                                                                                                                          • Opcode ID: cec0b6f0df781fb03655f54ad8b7534076037ad36cb93037665b42d75494d33c
                                                                                                                                                                                                                          • Instruction ID: 0d1fcea1eb045df93d00774c551f3289b560966c2a740d0f8707c9ada588ade5
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cec0b6f0df781fb03655f54ad8b7534076037ad36cb93037665b42d75494d33c
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3B31D433618A81E6D620EB14E4916ABB7B0FBC5784F401136E6CD8ABAADF2DD544CB40
                                                                                                                                                                                                                          Function 00007FF660AF85A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Base::Concurrency::details::ContextIdentityListQueueWork
                                                                                                                                                                                                                          • String ID: cannot get value
                                                                                                                                                                                                                          • API String ID: 3422067370-2333289761
                                                                                                                                                                                                                          • Opcode ID: 9ed778cc6a8f8d361e70c450a3090c2a854f450135a68dfd28d84f9f9c11bd79
                                                                                                                                                                                                                          • Instruction ID: 77605769481ae7e8d3b047b4c0e1946b4d4cf101a0dc59959a9864329f0995bf
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9ed778cc6a8f8d361e70c450a3090c2a854f450135a68dfd28d84f9f9c11bd79
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6B112653A0CA86E5EA70A72AE0413BD6774BFD57C4F904132E68D8B7A7DE6CD1458B00
                                                                                                                                                                                                                          Function 00007FF660B4EA80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                          • Source File: 0000000A.00000002.3618328822.00007FF660A81000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF660A80000, based on PE: true
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3618221396.00007FF660A80000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619305169.00007FF660CEB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619502626.00007FF660D32000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619615909.00007FF660D33000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619706190.00007FF660D48000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619797490.00007FF660D4A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D4F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3619883925.00007FF660D59000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          • Associated: 0000000A.00000002.3620021174.00007FF660D5C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                          • Snapshot File: hcaresult_10_2_7ff660a80000_PcAppStore.jbxd
                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                          • API ID: Concurrency::details::_SchedulerScheduler::_operator==
                                                                                                                                                                                                                          • String ID: 2
                                                                                                                                                                                                                          • API String ID: 2641387182-450215437
                                                                                                                                                                                                                          • Opcode ID: 1b7f05f116f92b6de5d85c8295a0d517e06cf233a030622378eca3cac154414a
                                                                                                                                                                                                                          • Instruction ID: 6cf2594dc2bf56e687630ef18ebc351c6c938885a4310927902c38e82a7e27d9
                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b7f05f116f92b6de5d85c8295a0d517e06cf233a030622378eca3cac154414a
                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 45110832618A85E2DA60DB15E4412EEB3A0FBC8784F404531E6CE8BB59DF7DD6058B40